cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
Size

468KB
MD5

2c33733b56c080cc7e1e3e6bf10ddff0
SHA1

3be008cfaf8bb40db7fba658446b228d51f2ea0c
SHA256

cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08e
SHA512

e939b722f988e7cbda6f715b30aad405b13336d10682d4feecb3a8e2f2de0e8b2045fcb04504dba2a9bae3df151a862814e0c71be41a54ffaa7a5e800b8a5705
SSDEEP

3072:KbClogy/I05UtbY+Pztjcf8/tCMvCzxp46KHeCVs0mfa84cV7c5l4:Kbgog8Ut5PJjcfl3H0mfLxV7c

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3040	Unicorn-7745.exe
1792	Unicorn-29635.exe
2852	Unicorn-26489.exe
2068	Unicorn-50740.exe
2628	Unicorn-31066.exe
2136	Unicorn-1347.exe
1384	Unicorn-11553.exe
2124	Unicorn-6900.exe
2668	Unicorn-56978.exe
2772	Unicorn-20671.exe
2900	Unicorn-59090.exe
2824	Unicorn-39224.exe
2912	Unicorn-58825.exe
1776	Unicorn-61786.exe
1076	Unicorn-33328.exe
3048	Unicorn-58993.exe
2380	Unicorn-50826.exe
396	Unicorn-30841.exe
1768	Unicorn-50707.exe
820	Unicorn-50707.exe
1832	Unicorn-50707.exe
976	Unicorn-18912.exe
108	Unicorn-14806.exe
1312	Unicorn-12397.exe
2188	Unicorn-34864.exe
2060	Unicorn-25933.exe
1736	Unicorn-14422.exe
568	Unicorn-1475.exe
1692	Unicorn-11873.exe
628	Unicorn-20116.exe
1496	Unicorn-442.exe
1256	Unicorn-20308.exe
2492	Unicorn-52331.exe
1608	Unicorn-26961.exe
2844	Unicorn-1995.exe
2836	Unicorn-27070.exe
2676	Unicorn-27070.exe
2680	Unicorn-23732.exe
2748	Unicorn-58865.exe
2704	Unicorn-55829.exe
2600	Unicorn-9472.exe
2268	Unicorn-43214.exe
1948	Unicorn-56108.exe
2276	Unicorn-29182.exe
2872	Unicorn-29182.exe
2164	Unicorn-29182.exe
3012	Unicorn-9316.exe
2880	Unicorn-41028.exe
2952	Unicorn-60629.exe
1036	Unicorn-35428.exe
2816	Unicorn-29099.exe
640	Unicorn-60894.exe
912	Unicorn-25848.exe
2984	Unicorn-25272.exe
2120	Unicorn-56613.exe
2432	Unicorn-53084.exe
1820	Unicorn-7412.exe
2232	Unicorn-42316.exe
1296	Unicorn-9524.exe
824	Unicorn-38859.exe
1876	Unicorn-26546.exe
1760	Unicorn-6296.exe
1360	Unicorn-59026.exe
1596	Unicorn-39056.exe

Loads dropped DLL 64 IoCs

pid	Process
2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
3040	Unicorn-7745.exe
2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
3040	Unicorn-7745.exe
2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
1792	Unicorn-29635.exe
1792	Unicorn-29635.exe
3040	Unicorn-7745.exe
3040	Unicorn-7745.exe
2852	Unicorn-26489.exe
2852	Unicorn-26489.exe
2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
2628	Unicorn-31066.exe
2068	Unicorn-50740.exe
2628	Unicorn-31066.exe
2068	Unicorn-50740.exe
3040	Unicorn-7745.exe
3040	Unicorn-7745.exe
2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
1384	Unicorn-11553.exe
2852	Unicorn-26489.exe
2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
2852	Unicorn-26489.exe
1384	Unicorn-11553.exe
2136	Unicorn-1347.exe
2136	Unicorn-1347.exe
1792	Unicorn-29635.exe
1792	Unicorn-29635.exe
2772	Unicorn-20671.exe
2772	Unicorn-20671.exe
3040	Unicorn-7745.exe
3040	Unicorn-7745.exe
1384	Unicorn-11553.exe
2824	Unicorn-39224.exe
2124	Unicorn-6900.exe
2900	Unicorn-59090.exe
1384	Unicorn-11553.exe
2824	Unicorn-39224.exe
2900	Unicorn-59090.exe
2124	Unicorn-6900.exe
2912	Unicorn-58825.exe
2912	Unicorn-58825.exe
2628	Unicorn-31066.exe
2628	Unicorn-31066.exe
2852	Unicorn-26489.exe
2852	Unicorn-26489.exe
2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
2668	Unicorn-56978.exe
2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
2668	Unicorn-56978.exe
2068	Unicorn-50740.exe
2068	Unicorn-50740.exe
1776	Unicorn-61786.exe
1776	Unicorn-61786.exe
2136	Unicorn-1347.exe
2136	Unicorn-1347.exe
1076	Unicorn-33328.exe
1076	Unicorn-33328.exe
2772	Unicorn-20671.exe
3048	Unicorn-58993.exe
2772	Unicorn-20671.exe
3048	Unicorn-58993.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2976	2816	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58177.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
3040	Unicorn-7745.exe
1792	Unicorn-29635.exe
2852	Unicorn-26489.exe
2628	Unicorn-31066.exe
2068	Unicorn-50740.exe
2136	Unicorn-1347.exe
1384	Unicorn-11553.exe
2124	Unicorn-6900.exe
2772	Unicorn-20671.exe
2668	Unicorn-56978.exe
2900	Unicorn-59090.exe
2824	Unicorn-39224.exe
2912	Unicorn-58825.exe
1776	Unicorn-61786.exe
1076	Unicorn-33328.exe
3048	Unicorn-58993.exe
2380	Unicorn-50826.exe
1768	Unicorn-50707.exe
976	Unicorn-18912.exe
396	Unicorn-30841.exe
1832	Unicorn-50707.exe
820	Unicorn-50707.exe
108	Unicorn-14806.exe
1312	Unicorn-12397.exe
2188	Unicorn-34864.exe
2060	Unicorn-25933.exe
1736	Unicorn-14422.exe
568	Unicorn-1475.exe
1692	Unicorn-11873.exe
628	Unicorn-20116.exe
1496	Unicorn-442.exe
1256	Unicorn-20308.exe
2492	Unicorn-52331.exe
1608	Unicorn-26961.exe
2836	Unicorn-27070.exe
2676	Unicorn-27070.exe
2844	Unicorn-1995.exe
2680	Unicorn-23732.exe
2748	Unicorn-58865.exe
2704	Unicorn-55829.exe
2600	Unicorn-9472.exe
2268	Unicorn-43214.exe
2872	Unicorn-29182.exe
1948	Unicorn-56108.exe
2164	Unicorn-29182.exe
3012	Unicorn-9316.exe
2276	Unicorn-29182.exe
2880	Unicorn-41028.exe
2952	Unicorn-60629.exe
640	Unicorn-60894.exe
1036	Unicorn-35428.exe
2816	Unicorn-29099.exe
912	Unicorn-25848.exe
2984	Unicorn-25272.exe
2120	Unicorn-56613.exe
2432	Unicorn-53084.exe
1820	Unicorn-7412.exe
1296	Unicorn-9524.exe
2232	Unicorn-42316.exe
824	Unicorn-38859.exe
1876	Unicorn-26546.exe
1760	Unicorn-6296.exe
1360	Unicorn-59026.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3040	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	31
PID 2720 wrote to memory of 3040	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	31
PID 2720 wrote to memory of 3040	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	31
PID 2720 wrote to memory of 3040	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	31
PID 3040 wrote to memory of 1792	3040	Unicorn-7745.exe	32
PID 3040 wrote to memory of 1792	3040	Unicorn-7745.exe	32
PID 3040 wrote to memory of 1792	3040	Unicorn-7745.exe	32
PID 3040 wrote to memory of 1792	3040	Unicorn-7745.exe	32
PID 2720 wrote to memory of 2852	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	33
PID 2720 wrote to memory of 2852	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	33
PID 2720 wrote to memory of 2852	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	33
PID 2720 wrote to memory of 2852	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	33
PID 1792 wrote to memory of 2068	1792	Unicorn-29635.exe	34
PID 1792 wrote to memory of 2068	1792	Unicorn-29635.exe	34
PID 1792 wrote to memory of 2068	1792	Unicorn-29635.exe	34
PID 1792 wrote to memory of 2068	1792	Unicorn-29635.exe	34
PID 3040 wrote to memory of 2628	3040	Unicorn-7745.exe	35
PID 3040 wrote to memory of 2628	3040	Unicorn-7745.exe	35
PID 3040 wrote to memory of 2628	3040	Unicorn-7745.exe	35
PID 3040 wrote to memory of 2628	3040	Unicorn-7745.exe	35
PID 2852 wrote to memory of 2136	2852	Unicorn-26489.exe	36
PID 2852 wrote to memory of 2136	2852	Unicorn-26489.exe	36
PID 2852 wrote to memory of 2136	2852	Unicorn-26489.exe	36
PID 2852 wrote to memory of 2136	2852	Unicorn-26489.exe	36
PID 2720 wrote to memory of 1384	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	37
PID 2720 wrote to memory of 1384	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	37
PID 2720 wrote to memory of 1384	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	37
PID 2720 wrote to memory of 1384	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	37
PID 2628 wrote to memory of 2124	2628	Unicorn-31066.exe	38
PID 2628 wrote to memory of 2124	2628	Unicorn-31066.exe	38
PID 2628 wrote to memory of 2124	2628	Unicorn-31066.exe	38
PID 2628 wrote to memory of 2124	2628	Unicorn-31066.exe	38
PID 2068 wrote to memory of 2668	2068	Unicorn-50740.exe	39
PID 2068 wrote to memory of 2668	2068	Unicorn-50740.exe	39
PID 2068 wrote to memory of 2668	2068	Unicorn-50740.exe	39
PID 2068 wrote to memory of 2668	2068	Unicorn-50740.exe	39
PID 3040 wrote to memory of 2772	3040	Unicorn-7745.exe	40
PID 3040 wrote to memory of 2772	3040	Unicorn-7745.exe	40
PID 3040 wrote to memory of 2772	3040	Unicorn-7745.exe	40
PID 3040 wrote to memory of 2772	3040	Unicorn-7745.exe	40
PID 2852 wrote to memory of 2824	2852	Unicorn-26489.exe	43
PID 2720 wrote to memory of 2912	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	41
PID 2852 wrote to memory of 2824	2852	Unicorn-26489.exe	43
PID 2852 wrote to memory of 2824	2852	Unicorn-26489.exe	43
PID 2720 wrote to memory of 2912	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	41
PID 2720 wrote to memory of 2912	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	41
PID 2852 wrote to memory of 2824	2852	Unicorn-26489.exe	43
PID 2720 wrote to memory of 2912	2720	cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe	41
PID 1384 wrote to memory of 2900	1384	Unicorn-11553.exe	42
PID 1384 wrote to memory of 2900	1384	Unicorn-11553.exe	42
PID 1384 wrote to memory of 2900	1384	Unicorn-11553.exe	42
PID 1384 wrote to memory of 2900	1384	Unicorn-11553.exe	42
PID 2136 wrote to memory of 1776	2136	Unicorn-1347.exe	44
PID 2136 wrote to memory of 1776	2136	Unicorn-1347.exe	44
PID 2136 wrote to memory of 1776	2136	Unicorn-1347.exe	44
PID 2136 wrote to memory of 1776	2136	Unicorn-1347.exe	44
PID 1792 wrote to memory of 3048	1792	Unicorn-29635.exe	45
PID 1792 wrote to memory of 3048	1792	Unicorn-29635.exe	45
PID 1792 wrote to memory of 3048	1792	Unicorn-29635.exe	45
PID 1792 wrote to memory of 3048	1792	Unicorn-29635.exe	45
PID 2772 wrote to memory of 1076	2772	Unicorn-20671.exe	46
PID 2772 wrote to memory of 1076	2772	Unicorn-20671.exe	46
PID 2772 wrote to memory of 1076	2772	Unicorn-20671.exe	46
PID 2772 wrote to memory of 1076	2772	Unicorn-20671.exe	46

C:\Users\Admin\AppData\Local\Temp\cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe
"C:\Users\Admin\AppData\Local\Temp\cb3459ee767080c71a460a6684a0d025e7ef2df150c54602ee437f95ec14e08eN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50740.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27070.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        8⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        9⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        9⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe
        9⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        9⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        8⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
        8⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
        8⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        7⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29362.exe
        8⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        8⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        8⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34577.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54752.exe
        7⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21678.exe
        7⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        6⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
        7⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42142.exe
        8⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29516.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55534.exe
        7⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        6⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52618.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        7⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
        6⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 240
        7⤵
        Program crash
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20818.exe
        6⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        6⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25272.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        6⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        7⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        7⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
        7⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        5⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19838.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41205.exe
        6⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51358.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48394.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20308.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35935.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        7⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        6⤵
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        6⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe
        7⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        6⤵
        
        PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        5⤵
        
        PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        5⤵
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
        5⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
        6⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        5⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe
      4⤵
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        5⤵
        
        PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        5⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        5⤵
        
        PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9693.exe
      4⤵
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe
      4⤵
      PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32824.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2576.exe
      4⤵
      PID:6912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31066.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58865.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30879.exe
        7⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        8⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        8⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        8⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1714.exe
        6⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        7⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53460.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        6⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55829.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        6⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        7⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        7⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        5⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28711.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22091.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61776.exe
        5⤵
        
        PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        6⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1334.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        6⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26143.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        5⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8655.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39439.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
        5⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22900.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        6⤵
        
        PID:236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe
      4⤵
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22913.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        5⤵
        
        PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
      4⤵
      PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
      4⤵
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33328.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20116.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9524.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
        7⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12289.exe
        8⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35982.exe
        8⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20427.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23137.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        7⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11957.exe
        6⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8323.exe
        7⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        7⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10445.exe
        6⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38859.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
        6⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33343.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        7⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23329.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        5⤵
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34254.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
        5⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61776.exe
        5⤵
        
        PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30195.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39056.exe
      4⤵
      Executes dropped EXE
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        5⤵
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        5⤵
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34894.exe
      4⤵
      PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29942.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
      4⤵
      PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59690.exe
      4⤵
      PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
      4⤵
      PID:7076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50826.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        5⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        6⤵
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57045.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        6⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        5⤵
        
        PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
        5⤵
        
        PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
      4⤵
      PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8361.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
      4⤵
      PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
      4⤵
      PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
      4⤵
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42325.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62361.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        5⤵
        
        PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
      4⤵
      PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57205.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
      4⤵
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
      4⤵
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
    3⤵
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
      4⤵
      PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
      4⤵
      PID:5796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
    3⤵
    PID:2176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8942.exe
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
    3⤵
    PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8581.exe
    3⤵
    PID:6772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56613.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        7⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58177.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        8⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2491.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23713.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        7⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10594.exe
        7⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2998.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        5⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25273.exe
        6⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        6⤵
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63251.exe
        5⤵
        
        PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25911.exe
        5⤵
        
        PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
      4⤵
      PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38159.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63913.exe
      4⤵
      PID:6916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39224.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39836.exe
        6⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        7⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3359.exe
        5⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1581.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62438.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2607.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exe
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16769.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8881.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62014.exe
      4⤵
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
        5⤵
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61576.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
      4⤵
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34894.exe
        5⤵
        
        PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29942.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
      4⤵
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42377.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10445.exe
      4⤵
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8616.exe
      4⤵
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        5⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37828.exe
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
      4⤵
      PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
      4⤵
      PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-563.exe
    3⤵
    PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48633.exe
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
      4⤵
      PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
    3⤵
    PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
    3⤵
    PID:5840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        6⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22900.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        7⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
        5⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36716.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65427.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10358.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23732.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
        5⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        6⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51331.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        6⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58062.exe
        6⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
        5⤵
        
        PID:284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
        5⤵
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        5⤵
        
        PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        5⤵
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16052.exe
        5⤵
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60759.exe
      4⤵
      PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2607.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        6⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30195.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59160.exe
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
      4⤵
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
      4⤵
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56108.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe
        5⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46494.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60457.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17237.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
      4⤵
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
      4⤵
      PID:6460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6727.exe
    3⤵
    PID:844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27918.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
      4⤵
      PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34254.exe
      4⤵
      PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
    3⤵
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27511.exe
    3⤵
    PID:6128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58825.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58825.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23329.exe
        6⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
      4⤵
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22900.exe
        5⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33848.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42154.exe
      4⤵
      PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9316.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe
      4⤵
      PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10404.exe
      4⤵
      PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
      4⤵
      PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
    3⤵
    PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
    3⤵
    PID:6056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
    3⤵
    PID:6376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25933.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25933.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30495.exe
      4⤵
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        5⤵
        
        PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
      4⤵
      PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
      4⤵
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
    3⤵
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4374.exe
      4⤵
      PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
    3⤵
    PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
    3⤵
    PID:3148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54586.exe
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10445.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2607.exe
    3⤵
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
      4⤵
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19007.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
      4⤵
      PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
      4⤵
      PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
    3⤵
    PID:2584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
    3⤵
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
    3⤵
    PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
    3⤵
    PID:6040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
  2⤵
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
    3⤵
    PID:4756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17026.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57962.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57962.exe
  2⤵
  PID:3784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe
  2⤵
  PID:4432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
  2⤵
  PID:5560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
  2⤵
  PID:6124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11873.exe

Filesize
468KB

MD5
df9ffac2fb8a1712738006177750857f

SHA1
7bde46167e0bacfc4bc96248694c0a219e14729c

SHA256
959a1579d6d29db548a3ed4a52be4b3a90b700441ce630317803db854c00d415

SHA512
06c311dc25a3cae602592c250ec0b8e79ac1063d1e4de964d8aa3f73ff9788d958f16041cd24301b8e0272d3c07fa935c37713cc13f401a0322663378420c5dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11957.exe

Filesize
468KB

MD5
6383cc30699e8d9a7d9a01809801d011

SHA1
38f68700da35799cbd9f5b775c3086980905a369

SHA256
8dbd0e8e6b13e626950b4da5031b2716d93ba67eebd83514f8df2d8d7acab5d9

SHA512
9c997923d980f076d1994fde1635f7b8285127177b6deee485c8d09a4df454ecb597021a8acc237ea623bc045bc63baf9990d3feb1dbc4b15ac2822824ef9ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe

Filesize
468KB

MD5
ceb2152a323a1cd3cee8b646b772747b

SHA1
31d73ee071376333dba1e2cf3be2e08092e3c73c

SHA256
3b1ba96a84ad280e75ddbaedde3e0652accd42ea1144349a3b773ead5a27b383

SHA512
d7b3552cba49d606e6ad1d9c501963a16edf0db82d2b56b2d168822be72fb3486bf881eacfeec92646b26334ccb70ab9e4cfff55d0a547c5320e8fca66066883

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31066.exe

Filesize
468KB

MD5
eab77b12075a5186f2b24be419e7d68b

SHA1
b45e44ead61f4e4dcbdd9b67773e268601bfc118

SHA256
ed8de9de6dc729f6e05da01a7a63b8e670ec21d6e32f59f224d14715120dd693

SHA512
98179bee8d2d3b344f5a14623499719ea9eaf2187e538dbc0dcbdf73e76804bd5b25650aa1739f8ae06a59c19942fe427967e683c0a9994226d130fa0aafdaad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33328.exe

Filesize
468KB

MD5
20bda8a59f9f7502e2d19d9176136f53

SHA1
4857f8f0d6b475600fc202d6f285a4c54cfbf4fd

SHA256
f3352f00309cde34940508a5c0a9438cfb18e97470497cfab6df00e41e8e1f1a

SHA512
88961a4d12ee77507e60ec4b435f18a708aa49f9dd0dfac1135365766ba2f73aeac06d5a801691382e9d25d5bf651f5e47886d9852d969aad001928f61267fd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33848.exe

Filesize
468KB

MD5
a9378145904eb8321f96f43d3cc11c73

SHA1
0ddb99347b47114225ae99350ae7609b22f78f98

SHA256
c02fd725e0feb0fd4f7f7846e1ba8b62aabcc5101276ac136762fbbd215f1758

SHA512
fbc24344b657df032bb6101847428886f4a3222beb156c5915a84b2562af30db33df9c3b143c49d9c300593c852773862062432ded627fd3006e02ca37db5918

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50740.exe

Filesize
468KB

MD5
d6208865460ba9d48ee7fa0f26f152f6

SHA1
4acc1204e8e4c6908919070af122f57d8dd63595

SHA256
90b158935fe86c4d3a22cd34a18f543b2f8286a96af284b442456edfd8b3d890

SHA512
bb7f141c33b87c278a4b98e5d7d269cb45110e9f5ade073f3e056b79fd5087b520ceabc30b4b453d770102d9c71c3299f194c408a8b06737721fb62f418b0fa3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe

Filesize
468KB

MD5
91249cb6216e69cd3abb8b40aff6762f

SHA1
c735aea6a4e2d5800d85d55630fe6757604b848f

SHA256
59cec9ce57cba67aceb85faebb03e4a862d9a28843dea4e1fe4da93202167215

SHA512
288471e14e1c91db70b575bca367b48c0905a2b5cebdb342a0f4614a1c99ad7870cb3f050ff111c482e79b2badbf1fd187728997b0a6911fd1a2136d71cd92d2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe

Filesize
468KB

MD5
b8097c28fc310d2e68b811f6eb17deb1

SHA1
55cde138b2154f2e85d08e20a10d41015c4e22d0

SHA256
fa0e4df4b846f04d1c604675975424e91fdb3cd7fbc69f7fd35dd390e525342e

SHA512
4d08a03ab901f1c804d8db1bcab83fd07c35e2f29c881992a9232fb97af51c6d5a31ae225d54047e8d98bf90a2064c567f18471e9470c54728b5426c0621ce91

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe

Filesize
468KB

MD5
9444bbedc6f54a1de26e043524aeb137

SHA1
7b56100368bf197bed0b0b3de4c4a15de9abaac8

SHA256
d6b87c45b9f48e61173bf147c7bc52e22d84901b2dcfbcf9cd5d27ac65895391

SHA512
97d0c20eb71f0c960edbc9b9d6424baa133c5e5008f360667d0842eee41dc69ba3d13a7242ba7af9cf31e3a84f3b0d47681eeae72e59c9a88a46ae20ca73a3f1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe

Filesize
468KB

MD5
c7290113b0624ef080ff2b0060727c9d

SHA1
2e3b56fb98a54131e3eb4ec4aeb108cdb28ff2a7

SHA256
d6d1c36c9950348483002075f5f46a69c194be15039b95d0983a7eff606cb9be

SHA512
c61dcd5a20333a20f38ab3e79df27f6b31ea983f03a97c31c439f1de62ec34955e5dab62ae881ffdcab2432a887c3fec6e2f20952a49900fbe882fc8da6be1f3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39224.exe

Filesize
468KB

MD5
4d3c5c9c0268f6f25d8517b12e0aa0b4

SHA1
f856dd9746dea0a11200db53015a4f8e1ea83c21

SHA256
c3039fc60b206490f75d0698843f5fc01cef0581c51351147ff58ffb711b91ab

SHA512
f64f0b7c501a2bf21b5ab792ef245aa03ba30748d27c703177906adf4f9d8fce87ea3cd40505fd08a45148f62581caf051c2009fd3b4feeafb8f3c76f932c1bb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50826.exe

Filesize
468KB

MD5
a7d3fd8925d2d768efd70ef6a6e5dd24

SHA1
3ee57df96b9f1d0457aebbf8a1cf2672315b5429

SHA256
25eeb29e6f3bdf6938396910e771545b39e95bfc687609c508831156118e8778

SHA512
3e5a98ce5772dc450858f322dd3b3ec4a59d40c0e71347f22f4c339c40fb3a66ba0009813d36998deb786d3035d804bea5d8d7f68c2ec4320e1b233d7403e755

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe

Filesize
468KB

MD5
05126b867c478ff3f82182ae6a5b1e89

SHA1
4d08c16aa062d73aaf26d3f84d22ab9819bb8db2

SHA256
97e4ab33bb5ad23e5c046cab9125dece6c0d121fd584d5e69616323e630f7b50

SHA512
ef502d01dc83987326e22bbf8357876874bf1f8e8962b9bdc6241587b0091e15f1b6c49f798b34e9f15f8d09842334637c7a621cab93c404eae18c2797107ba6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58825.exe

Filesize
468KB

MD5
40d37f4de4e2a6a8e900570554374f41

SHA1
ecb9cfb244d5dcece499e2f7b935aa4a07886102

SHA256
1fadb0b2dc309e3f2d6cb02bffad4bd131e76e443cc459cf9fd7a1e86758fb62

SHA512
47a1f179c3aebc5dba5f8aeed9e4acab26605cd5631c94c5cd01d3219e6307fd61d88723423b2d8010227f3d2aa8af3dd02ba40e147d9d4450748707f14048c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe

Filesize
468KB

MD5
862d0ddd83d6e78b2c775d50f635cc87

SHA1
17c892389b9b33fc4ba8cfa5f8107ebdbe3088aa

SHA256
a642926db22ff44918d562a35da685a6ed73e91ce78391c65fe947e852d2023b

SHA512
ff412603b21ea3ee6a86437c027c2d6561ad903bf9fe148da375e27f4fec3b63228ddd39e48533e4cb2922bc1c5636a9a1e5a51fe365cc94e36b0f31565b597a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe

Filesize
468KB

MD5
7fb922b6ad0858c96145ffba86e48fb7

SHA1
b74a329d1429f0e987dfcfee64e61e8f7efef267

SHA256
5412da979407411e5b216fe1dd9f0c387c50480159b61f023e946797b218bf61

SHA512
275dcf85c99cb454e049e6afdc1bf6f2bcb3e3516d47c69b7ed46830e77531a1b23ee4d84af431f7b528296114c33000daf7d47d47585629f07c58c07185f71b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe

Filesize
468KB

MD5
fd77fe14b4f0e92f6a0fd40e69871501

SHA1
639fe537984015fb4c6abf58f11167eb5d5f9384

SHA256
2f20825620263c11185cdec8862ba0da74b9f42fb95d34ad23755ce75a13d5b9

SHA512
4542ea18d709c99ec376ae2ea4e1f199a29ec1640d0a5b2b9e856073a9a824113d050013b7e5002f34cec0dfc32003cebc0c9c759f7e123d1effbc48160acf46

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe

Filesize
468KB

MD5
5aabb44eb13ac98d8b0316bce5fa7b2b

SHA1
12d34d973f9937001a5263469c0f806a8c796b69

SHA256
af1b8ada528249f1ed6e083096a23b82628a2c9b2d4b52101dfa2c05f583d16d

SHA512
a0229986e0deea70d41e943db796f5348cf378e316b5827a633e02cdbcb1ebeacc3dbe684804eea874f7900428dc20d0370420094604cb76c7b1425c775669f4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe

Filesize
468KB

MD5
a82ab48c936afbd2954845c726e4e7e1

SHA1
9165336d42ac19d5322bb084926bb826fe243e60

SHA256
f21dd901504a4b233f0e4fa81d3e253ed9ab56997ed0c7293eece26823782b85

SHA512
c2b00e4d432a15893c53b2a95b70e67292f3cb669ee1f9f0cc58558bc439b243c246abb9d70bf44d4d7f7743db5cf36d55549bbce8783ffb124c26221fafce30

Download Submit