82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603

Analysis

max time kernel
117s
max time network
21s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 09:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
Size

468KB
MD5

c4a809e11b7c0b04d928710dcb9c90b0
SHA1

248b0a1dfeb919245eb7818a9b98e5bc5b6de8c9
SHA256

82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603
SHA512

e197f005e8fe9aa9f048a9c0828222c5f7803959cbdbcfcf89a4268e69fc6ed052fc27e3fdf8fa32da1fe08cadb476c18d2db5cf44467bc80795d5cc6a9c8725
SSDEEP

3072:KbCKog/nI95UtFYiEAtjcf8+qCaSCzgpacDHeGVfroLI8tHfukwlm:KbzoJ7UtbEsjcfKcEuoLZhfuk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2696	Unicorn-42102.exe
2796	Unicorn-34100.exe
2384	Unicorn-26486.exe
2720	Unicorn-10638.exe
2596	Unicorn-24928.exe
2984	Unicorn-11193.exe
1528	Unicorn-53425.exe
1500	Unicorn-24090.exe
2060	Unicorn-54769.exe
2164	Unicorn-25434.exe
2428	Unicorn-33602.exe
1720	Unicorn-57841.exe
316	Unicorn-51976.exe
536	Unicorn-29409.exe
2924	Unicorn-49829.exe
2928	Unicorn-49319.exe
552	Unicorn-64172.exe
3048	Unicorn-30753.exe
2124	Unicorn-7025.exe
1304	Unicorn-29492.exe
1992	Unicorn-49912.exe
1868	Unicorn-38214.exe
1764	Unicorn-62164.exe
2332	Unicorn-8117.exe
1132	Unicorn-17048.exe
1748	Unicorn-1266.exe
2448	Unicorn-29035.exe
2892	Unicorn-35159.exe
340	Unicorn-35521.exe
824	Unicorn-63555.exe
1700	Unicorn-2657.exe
2960	Unicorn-18439.exe
2100	Unicorn-51666.exe
2196	Unicorn-63171.exe
2652	Unicorn-15506.exe
1620	Unicorn-15506.exe
2752	Unicorn-16061.exe
2784	Unicorn-58385.exe
2724	Unicorn-58385.exe
2840	Unicorn-60431.exe
2792	Unicorn-60431.exe
2188	Unicorn-31651.exe
2564	Unicorn-21436.exe
2684	Unicorn-26605.exe
2616	Unicorn-63561.exe
2432	Unicorn-11038.exe
2416	Unicorn-27375.exe
2220	Unicorn-43446.exe
1536	Unicorn-42642.exe
2056	Unicorn-60047.exe
2088	Unicorn-55449.exe
2632	Unicorn-42185.exe
2612	Unicorn-42450.exe
1060	Unicorn-31821.exe
236	Unicorn-44541.exe
1068	Unicorn-52730.exe
3064	Unicorn-57369.exe
820	Unicorn-56622.exe
448	Unicorn-17627.exe
1944	Unicorn-48262.exe
1976	Unicorn-7784.exe
1364	Unicorn-27650.exe
1708	Unicorn-20036.exe
3040	Unicorn-4489.exe

Loads dropped DLL 64 IoCs

pid	Process
3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
2696	Unicorn-42102.exe
2696	Unicorn-42102.exe
3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
2384	Unicorn-26486.exe
2384	Unicorn-26486.exe
3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
2696	Unicorn-42102.exe
2696	Unicorn-42102.exe
2796	Unicorn-34100.exe
2796	Unicorn-34100.exe
2720	Unicorn-10638.exe
2720	Unicorn-10638.exe
2384	Unicorn-26486.exe
2384	Unicorn-26486.exe
2984	Unicorn-11193.exe
2984	Unicorn-11193.exe
2596	Unicorn-24928.exe
2596	Unicorn-24928.exe
3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
2696	Unicorn-42102.exe
2696	Unicorn-42102.exe
1528	Unicorn-53425.exe
1528	Unicorn-53425.exe
1500	Unicorn-24090.exe
1500	Unicorn-24090.exe
2796	Unicorn-34100.exe
2796	Unicorn-34100.exe
2720	Unicorn-10638.exe
2720	Unicorn-10638.exe
2060	Unicorn-54769.exe
2060	Unicorn-54769.exe
2384	Unicorn-26486.exe
2384	Unicorn-26486.exe
2428	Unicorn-33602.exe
2428	Unicorn-33602.exe
1720	Unicorn-57841.exe
1720	Unicorn-57841.exe
2596	Unicorn-24928.exe
2596	Unicorn-24928.exe
2164	Unicorn-25434.exe
2164	Unicorn-25434.exe
3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
316	Unicorn-51976.exe
316	Unicorn-51976.exe
2984	Unicorn-11193.exe
2984	Unicorn-11193.exe
2696	Unicorn-42102.exe
2696	Unicorn-42102.exe
536	Unicorn-29409.exe
536	Unicorn-29409.exe
1528	Unicorn-53425.exe
1528	Unicorn-53425.exe
2924	Unicorn-49829.exe
2924	Unicorn-49829.exe
1500	Unicorn-24090.exe
1500	Unicorn-24090.exe
3048	Unicorn-30753.exe
3048	Unicorn-30753.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
660	2892	WerFault.exe	58
1752	536	WerFault.exe	44
2132	1068	WerFault.exe	86
3216	3064	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40191.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
2696	Unicorn-42102.exe
2796	Unicorn-34100.exe
2384	Unicorn-26486.exe
2720	Unicorn-10638.exe
2596	Unicorn-24928.exe
2984	Unicorn-11193.exe
1528	Unicorn-53425.exe
1500	Unicorn-24090.exe
2060	Unicorn-54769.exe
2428	Unicorn-33602.exe
1720	Unicorn-57841.exe
2164	Unicorn-25434.exe
316	Unicorn-51976.exe
536	Unicorn-29409.exe
2928	Unicorn-49319.exe
2924	Unicorn-49829.exe
552	Unicorn-64172.exe
3048	Unicorn-30753.exe
1304	Unicorn-29492.exe
2124	Unicorn-7025.exe
1992	Unicorn-49912.exe
1868	Unicorn-38214.exe
2332	Unicorn-8117.exe
1764	Unicorn-62164.exe
1748	Unicorn-1266.exe
1132	Unicorn-17048.exe
2448	Unicorn-29035.exe
2892	Unicorn-35159.exe
340	Unicorn-35521.exe
824	Unicorn-63555.exe
2960	Unicorn-18439.exe
1700	Unicorn-2657.exe
2100	Unicorn-51666.exe
2196	Unicorn-63171.exe
1620	Unicorn-15506.exe
2652	Unicorn-15506.exe
2752	Unicorn-16061.exe
2724	Unicorn-58385.exe
2564	Unicorn-21436.exe
2792	Unicorn-60431.exe
2784	Unicorn-58385.exe
2188	Unicorn-31651.exe
2616	Unicorn-63561.exe
2684	Unicorn-26605.exe
2432	Unicorn-11038.exe
2416	Unicorn-27375.exe
2220	Unicorn-43446.exe
1536	Unicorn-42642.exe
2056	Unicorn-60047.exe
2088	Unicorn-55449.exe
1060	Unicorn-31821.exe
2632	Unicorn-42185.exe
2612	Unicorn-42450.exe
236	Unicorn-44541.exe
1068	Unicorn-52730.exe
3064	Unicorn-57369.exe
820	Unicorn-56622.exe
448	Unicorn-17627.exe
1944	Unicorn-48262.exe
1364	Unicorn-27650.exe
1976	Unicorn-7784.exe
1708	Unicorn-20036.exe
3040	Unicorn-4489.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2696	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	31
PID 3052 wrote to memory of 2696	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	31
PID 3052 wrote to memory of 2696	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	31
PID 3052 wrote to memory of 2696	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	31
PID 2696 wrote to memory of 2796	2696	Unicorn-42102.exe	32
PID 2696 wrote to memory of 2796	2696	Unicorn-42102.exe	32
PID 2696 wrote to memory of 2796	2696	Unicorn-42102.exe	32
PID 2696 wrote to memory of 2796	2696	Unicorn-42102.exe	32
PID 3052 wrote to memory of 2384	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	33
PID 3052 wrote to memory of 2384	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	33
PID 3052 wrote to memory of 2384	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	33
PID 3052 wrote to memory of 2384	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	33
PID 2384 wrote to memory of 2720	2384	Unicorn-26486.exe	34
PID 2384 wrote to memory of 2720	2384	Unicorn-26486.exe	34
PID 2384 wrote to memory of 2720	2384	Unicorn-26486.exe	34
PID 2384 wrote to memory of 2720	2384	Unicorn-26486.exe	34
PID 3052 wrote to memory of 2596	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	35
PID 3052 wrote to memory of 2596	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	35
PID 3052 wrote to memory of 2596	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	35
PID 3052 wrote to memory of 2596	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	35
PID 2696 wrote to memory of 2984	2696	Unicorn-42102.exe	36
PID 2696 wrote to memory of 2984	2696	Unicorn-42102.exe	36
PID 2696 wrote to memory of 2984	2696	Unicorn-42102.exe	36
PID 2696 wrote to memory of 2984	2696	Unicorn-42102.exe	36
PID 2796 wrote to memory of 1528	2796	Unicorn-34100.exe	37
PID 2796 wrote to memory of 1528	2796	Unicorn-34100.exe	37
PID 2796 wrote to memory of 1528	2796	Unicorn-34100.exe	37
PID 2796 wrote to memory of 1528	2796	Unicorn-34100.exe	37
PID 2720 wrote to memory of 1500	2720	Unicorn-10638.exe	38
PID 2720 wrote to memory of 1500	2720	Unicorn-10638.exe	38
PID 2720 wrote to memory of 1500	2720	Unicorn-10638.exe	38
PID 2720 wrote to memory of 1500	2720	Unicorn-10638.exe	38
PID 2384 wrote to memory of 2060	2384	Unicorn-26486.exe	39
PID 2384 wrote to memory of 2060	2384	Unicorn-26486.exe	39
PID 2384 wrote to memory of 2060	2384	Unicorn-26486.exe	39
PID 2384 wrote to memory of 2060	2384	Unicorn-26486.exe	39
PID 2984 wrote to memory of 2164	2984	Unicorn-11193.exe	40
PID 2984 wrote to memory of 2164	2984	Unicorn-11193.exe	40
PID 2984 wrote to memory of 2164	2984	Unicorn-11193.exe	40
PID 2984 wrote to memory of 2164	2984	Unicorn-11193.exe	40
PID 2596 wrote to memory of 2428	2596	Unicorn-24928.exe	41
PID 2596 wrote to memory of 2428	2596	Unicorn-24928.exe	41
PID 2596 wrote to memory of 2428	2596	Unicorn-24928.exe	41
PID 2596 wrote to memory of 2428	2596	Unicorn-24928.exe	41
PID 3052 wrote to memory of 1720	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	42
PID 3052 wrote to memory of 1720	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	42
PID 3052 wrote to memory of 1720	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	42
PID 3052 wrote to memory of 1720	3052	82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe	42
PID 2696 wrote to memory of 316	2696	Unicorn-42102.exe	43
PID 2696 wrote to memory of 316	2696	Unicorn-42102.exe	43
PID 2696 wrote to memory of 316	2696	Unicorn-42102.exe	43
PID 2696 wrote to memory of 316	2696	Unicorn-42102.exe	43
PID 1528 wrote to memory of 536	1528	Unicorn-53425.exe	44
PID 1528 wrote to memory of 536	1528	Unicorn-53425.exe	44
PID 1528 wrote to memory of 536	1528	Unicorn-53425.exe	44
PID 1528 wrote to memory of 536	1528	Unicorn-53425.exe	44
PID 1500 wrote to memory of 2924	1500	Unicorn-24090.exe	45
PID 1500 wrote to memory of 2924	1500	Unicorn-24090.exe	45
PID 1500 wrote to memory of 2924	1500	Unicorn-24090.exe	45
PID 1500 wrote to memory of 2924	1500	Unicorn-24090.exe	45
PID 2796 wrote to memory of 2928	2796	Unicorn-34100.exe	46
PID 2796 wrote to memory of 2928	2796	Unicorn-34100.exe	46
PID 2796 wrote to memory of 2928	2796	Unicorn-34100.exe	46
PID 2796 wrote to memory of 2928	2796	Unicorn-34100.exe	46

C:\Users\Admin\AppData\Local\Temp\82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe
"C:\Users\Admin\AppData\Local\Temp\82df2404ee8249f280ce8b81abdca2c2a152204b643a26facd29b711d6da2603N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 376
        8⤵
        Program crash
        
        PID:2132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 376
        7⤵
        Program crash
        
        PID:660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57369.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        7⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 376
        7⤵
        Program crash
        
        PID:3216
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 376
        6⤵
        Program crash
        
        PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35521.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56622.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49819.exe
        7⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53518.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        7⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18853.exe
        6⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13405.exe
        6⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        6⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33977.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7692.exe
        5⤵
        
        PID:328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        5⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        6⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53348.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
        7⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        6⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58028.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18107.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3088.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
        5⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20530.exe
        5⤵
        
        PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9279.exe
        5⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25742.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        5⤵
        
        PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-349.exe
      4⤵
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35061.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60186.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6441.exe
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11193.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62164.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48018.exe
        7⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
        6⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13021.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
        7⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31821.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        6⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        7⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31525.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe
        6⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60279.exe
        5⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20497.exe
        6⤵
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36444.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21684.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48958.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        6⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51646.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        7⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44583.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3399.exe
        5⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63498.exe
        6⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        6⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14990.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20530.exe
        5⤵
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32092.exe
        5⤵
        
        PID:596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        5⤵
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
      4⤵
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19909.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
      4⤵
      PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
      4⤵
      PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
      4⤵
      PID:6612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
        6⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47193.exe
        7⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        7⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        6⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
        5⤵
        
        PID:544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55449.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60680.exe
        5⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35421.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
      4⤵
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        5⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
      4⤵
      PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
      4⤵
      PID:6328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29035.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exe
        5⤵
        
        PID:584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28974.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        5⤵
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        5⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
      4⤵
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-77.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-77.exe
        5⤵
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61563.exe
      4⤵
      PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63561.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
      4⤵
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        6⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
      4⤵
      PID:352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe
      4⤵
      PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
    3⤵
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe
      4⤵
      PID:7160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
    3⤵
    PID:3272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
    3⤵
    PID:4280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11884.exe
    3⤵
    PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
    3⤵
    PID:6600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10638.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
        8⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        8⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        7⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe
        7⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8597.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        7⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        6⤵
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
        6⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4489.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        7⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53137.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        7⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2875.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34869.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22925.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60186.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10399.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28925.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18779.exe
        5⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        6⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        6⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17219.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        5⤵
        
        PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60431.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13124.exe
        6⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7039.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35421.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exe
        5⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31892.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        5⤵
        
        PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9279.exe
        5⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21266.exe
      4⤵
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        5⤵
        
        PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
      4⤵
      PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
      4⤵
      PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
      4⤵
      PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30753.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27650.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exe
        7⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        7⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        6⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        6⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25509.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        5⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40032.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65449.exe
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        6⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        7⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        6⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50959.exe
      4⤵
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        5⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
      4⤵
      PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
      4⤵
      PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe
      4⤵
      PID:6240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7025.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42642.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
        5⤵
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
      4⤵
      PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
      4⤵
      PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32092.exe
      4⤵
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
      4⤵
      PID:6952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-349.exe
    3⤵
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
      4⤵
      PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
      4⤵
      PID:7016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6441.exe
    3⤵
    PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
    3⤵
    PID:6256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42450.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45735.exe
        6⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35061.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35421.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        5⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44541.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33592.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25742.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        5⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11400.exe
      4⤵
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7219.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11113.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40032.exe
      4⤵
      PID:6772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65449.exe
        5⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        6⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20954.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16978.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9154.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        5⤵
        
        PID:784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39843.exe
        5⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37223.exe
      4⤵
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
        5⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-556.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20272.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
      4⤵
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26820.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8313.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58156.exe
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
      4⤵
      PID:6656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
      4⤵
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
        5⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37934.exe
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28879.exe
      4⤵
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31525.exe
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
      4⤵
      PID:6916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27852.exe
    3⤵
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
      4⤵
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
      4⤵
      PID:6304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26187.exe
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
    3⤵
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
    3⤵
    PID:5680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
    3⤵
    PID:5888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
    3⤵
    PID:6996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49912.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61305.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        6⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        5⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40032.exe
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16035.exe
      4⤵
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
        5⤵
        
        PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        5⤵
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
      4⤵
      PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26024.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61563.exe
      4⤵
      PID:6864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9279.exe
      4⤵
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        5⤵
        
        PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
      4⤵
      PID:7032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
    3⤵
    PID:5040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe
    3⤵
    PID:7152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60431.exe
    3⤵
    - Executes dropped EXE
    PID:2840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20311.exe
    3⤵
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
      4⤵
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49048.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
    3⤵
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
    3⤵
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58505.exe
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
    3⤵
    PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44583.exe
    3⤵
    PID:6616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
    3⤵
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
      4⤵
      PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8062.exe
      4⤵
      PID:5240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
    3⤵
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
    3⤵
    PID:6104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
    3⤵
    PID:6760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
  2⤵
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
    3⤵
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
    3⤵
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23169.exe
    3⤵
    PID:6468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10109.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10109.exe
  2⤵
  PID:4288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16084.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16084.exe
  2⤵
  PID:5688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10638.exe

Filesize
468KB

MD5
d3c3d2b852e168d2174026bd87fd8846

SHA1
b63cd628faba210ad4a25188a1ebe429bfaa4511

SHA256
7cfe66965c52a978517e8aacdf1bf43c7a913cbac28a4a80c0eb32cbc1b4787e

SHA512
f1406e3c14e63a29d84e005a0052953ef56a191581148ef7edb1d342ed7d2ab43616cce2f0d2e68a11ef6ddbef5775ab73cba85d0c6eaf81f61395ea9e309a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11193.exe

Filesize
468KB

MD5
2fbfa44564f3ec5ca8567501361a8657

SHA1
28900649388b7ea31cd5c324ab7f56a0407093b2

SHA256
d4648bcf5c732d07ac53c5c3d4f1b97bd9548b9024bbb2c4903272292883fbad

SHA512
7b479a45ebebb4cde11e84723fb91fa8bd95424b35fc974c490105adb3376180acf1ab371e44171e8c44fc595c469e278515004d1863856bdc93079b1d57bd89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe

Filesize
468KB

MD5
891a5858759cd64e0cd67e2f44205008

SHA1
97ef6b11ce3ecbaa4579f72ceaf3993717cfc672

SHA256
2fcdf375e2ec0c09d34941e0506a355b1e26f925dacde1011930cd2fff37a10c

SHA512
a84a5c20c6a6c839ed56b84ba4c82946d4658f13e2c4076709db8df1ef89365cca7a8c03ea93b097ff5852f4e50deea68dd704db81e592ea285d07bc0ad1a0be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe

Filesize
468KB

MD5
0a151e11ec63449c152d113bfc190d1e

SHA1
587a17dfea6afe4fbf5eb2a8d20085c7c09104c4

SHA256
6bd5041893c565abc4c551fb7997c9c9b812c0a3585b5850a90141ed0a2fbaf3

SHA512
00ef8d87e14ff21bd586ff66f28917476e60d19f044bc5273ee5c906d18b950a1d64d2ea9b25e85c9c6d713ae1c0425c3a4a69b65447dfb179e916035b4bd99f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe

Filesize
468KB

MD5
680d7a9f519fcf067976848394ea125a

SHA1
5453571ee13a9c9611f12bc1b3da0a4070d6f1e1

SHA256
d5320a52f2ed98c5dfb5992301aa8ad063afbf2af1ca7d9ecad0b24855f66827

SHA512
1637e5cecaa32ef6620233028f295609c1d3fd61bcae84ef4bca3c37b318c2d29dc9597c5b9861736d210590863b6e173d311740cf5ae07e67efb688e069ff60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe

Filesize
468KB

MD5
c273cbaad2c4fd46a7e95dc936c69969

SHA1
cad7a8a0a567e76daf664cd69cb73b08b3f023d5

SHA256
3e4722cfc2b7ac3049b8c617ee233906b644d0adba8a14e707f2f5309d4e3191

SHA512
c21f37e4a1c7ad4616891a7868393691db74e7f24db5e086fa68cb910c799772c6c71bb601f97f128bf2caf4025de3b2dcbca22366487706445a52d431ac5215

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe

Filesize
468KB

MD5
bf07d2009a8f757a47b6ea14df07f32f

SHA1
c2831aaebd8710ce1037c61108869391325c959a

SHA256
556c6355f0fc8d19b1e8f1141db54db4e170d9598860371a60469ebecf8ca345

SHA512
02d705f648cca273e51da174349d75b7242f863f122487ba2829a5f51f049bff7ac65658f86dec3ec6a387a87455a512df212f3eb3f6a13899704d9fa9d5aff3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe

Filesize
468KB

MD5
60b8b4c5b71f9dc9f1063b888b2e9e2b

SHA1
472c4d39acd815fa156f1c55f3d4dcaea6b8fab8

SHA256
c18a024197bf66e32a776b8249abff11f6530079ea0185886092be92aa6666b1

SHA512
9d7499430b10b97dac352a098829b14775d48dda1d9be74f46c11ee7ad505289ab6d85cf3f804f946fb70779389fda52c260fdc6dd59779c79bcdf5e41acd9c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe

Filesize
468KB

MD5
da500334959fb48d3796eacb21d01c7a

SHA1
e7ab22d54a083d1fe66e32e9e316312ef4e8c4eb

SHA256
f4136f342e1d05cf6cb435f2bea5dc4c91f0319373e8ca5ce2d827477a0cc5d3

SHA512
23764c1767557cd20c8f6ab23c901eaedc814153e5771bb4881b093ef914d36e27e33c236d3f996833f8d981b30a34864cca9268bbf473a0e6dc34536afab9f5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30753.exe

Filesize
468KB

MD5
a12ad87ee02e570c2f494eeb121f80ab

SHA1
ff4bf81fb18939ce9cf311bdea36d1902b18b725

SHA256
7ba2b583a82898c508ab841250f8342a12a1e1fc5fc1f66c84b4ce969f6d1b60

SHA512
947f3db748c54db03999d1191f12e56d21b5fd74343cbb826fed241721b96c1e10fffac614fa048b308e542ef181a133fb067a9e2de4106322ea21325002cb3d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe

Filesize
468KB

MD5
6b889c98288f4e2f9edfcfa108be3fc5

SHA1
df52eb48b32d4d8db243a06038d1c317c0fb6d09

SHA256
ef3888157d811ad4d5365472e539f8e47b95b54853b89d06d34efc34a87d0ce5

SHA512
5c4f68bffa55103267658d00c7c238afe9bd11a86ab5c182a0ef3e5298dd0f0bfa55a1f3a22caed6333eb047281ef6ee26c72249492198be85577b5f873c835c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe

Filesize
468KB

MD5
3cc6880bc2bda6a6ae683485e5de9a28

SHA1
4ca10598089eb242593762cd9d62c31521b1ef28

SHA256
fbbabc0d19a576f95012d41579b77aabb238486f396e21e138fb43c2c88de21c

SHA512
4e954d4333fa8eb25710118c16e38ef202017509bed1fe7098c0d96f161fc251de95965c0236833de57702f10184ca73f226707f5d45d6a960a17ed16cace9b1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe

Filesize
468KB

MD5
7c9fce437e75330e6862f44eab87a622

SHA1
c5e0772b5ddd4a0a6d699749f9f2e801a5b8e722

SHA256
f05b1e38ccd2d9642f6a0e10a9aa376e584a29f0bb802c5b0259132f1dbfe026

SHA512
90544ebbcb8cbbb64194cc23030906e4d35c3eab1a38589cd0beeac28a7c6ff86ddff5c94afee9b68c8f37f089401c2eab1a9479410f6266e793ac3351a8bec5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe

Filesize
468KB

MD5
f968ec9efc010d2212f9e53554270ddf

SHA1
e742cfc20310a8ecf761b7d46da17653b7fdfdd6

SHA256
b46074c0e714d0dbd463c9003e34ee5da953235f48ed20c456c7157f6b5a577b

SHA512
1a914596a01f652149239d4efb4400647e2677fa744f6557d42f812239451526113200c4539fa2eb8aa4b0465dc9b696aaa687206c36bbcd082b2d13e0162f69

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe

Filesize
468KB

MD5
31de4de00bf4320291a68694ec686f20

SHA1
470fefeac2ce350230df1484bcd3f3a7a0393f2d

SHA256
6a3d325fa4ffef76c9b0d3a58c65dcbd2255566ee17932128ad05fbf31f9cb74

SHA512
3c807958bd4e97fa2e97819169f271796c404c2584ad33a2ce909f6eaa568873d81a91de41d9f7d1565b4d96e54757562ed238bc81e4a19c5f6822142038e116

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe

Filesize
468KB

MD5
81dd998dd69feac742f799375af37295

SHA1
f4fcde07d31ed926ad5718333d8d6dbc3bbc392e

SHA256
e7809d9a6705b02dce88eb4330da2589cd8d1409149c57c97e9b4fd33083880a

SHA512
7beb299e6b4a439eb9231fe06c4635cf1c83a711e6b2c44f133c5c98aef1016ddb458f36d5d3c2929ff27dbfb16cec41df0ba995965a271fe5dcafe9af2c9f64

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe

Filesize
468KB

MD5
5fa3c76bf471ec23b45b2f554cbe931b

SHA1
6dd57de7721a5a5313845cfc97661e306b78fcb1

SHA256
aa3fa4eee85b506134a6f4e74d389c2d3c7d0da4b7cc128d93e446a9822a8108

SHA512
7988928e58f0293e463c8d5036bc6dea2124a77765d2e289aaf50067adb74723a98b3070aed73dc43ea9f0dd84b1c359eff8080e9f34d2b76a2ae4dfca3545fc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe

Filesize
468KB

MD5
f18786af9092a3cbb770df3fa85f6edd

SHA1
a4f004c71e969b6a7802308bef995d8c30c67494

SHA256
dccf34a87d335a68d1c18e9ae531efe2d54a75fb7a9a2b9046c1137caa5bee6b

SHA512
f08750482980af21eb29d04b43110a05bcd086a767bd2a47f63ee4f4e1cb335ba228e1da408adb47f9e97a0eb83c4c7041c4c4fdbe051cf2fde192486541ed37

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe

Filesize
468KB

MD5
01a6fa447ae84c592b432352819e9f78

SHA1
932b48b6759dc50f5807afb4b2c626efe585e9e1

SHA256
fabc12a5373ec57e313b33e036a5ee280094060c2aee175e432f20082a5eb932

SHA512
038a991bc43c3947b72eb5607391768b663a3ea4673e8130f48fddaeea5875a2a7879c21ddb8c3b20dd5ac800221ca6e1b22460810957f4eac1d3aa6e2684c99

Download Submit