410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767

Analysis

max time kernel
116s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
Size

468KB
MD5

fb87547af9411589fb9ecd2688851990
SHA1

44c1196352ee848140cd7086aea138165542e34e
SHA256

410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767
SHA512

afdf56ad930e9120c85b84f193b52975e11fe8cb2e4df0c5611025a61417b5be8bc5d4c89415c2e23a099aa50cf1a928df0e50c17922bb17d36f93213f8795a0
SSDEEP

3072:3FOnogwxZ2TU2bYpBz3yqf8/EJ3jyIplPmfC5VLd1JZ+W3Xjtyld:3F+oJYU2qBDyqfM0/91JcUXjt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2816	Unicorn-12139.exe
1668	Unicorn-6130.exe
2864	Unicorn-62985.exe
2524	Unicorn-29369.exe
1816	Unicorn-34007.exe
1528	Unicorn-37729.exe
1948	Unicorn-47935.exe
2172	Unicorn-37340.exe
2180	Unicorn-16405.exe
2516	Unicorn-53868.exe
2856	Unicorn-47738.exe
2360	Unicorn-47620.exe
2460	Unicorn-27754.exe
1604	Unicorn-63956.exe
2092	Unicorn-14874.exe
2364	Unicorn-6945.exe
1820	Unicorn-50609.exe
1588	Unicorn-21274.exe
2236	Unicorn-45377.exe
2064	Unicorn-62690.exe
2480	Unicorn-50355.exe
2400	Unicorn-50547.exe
1868	Unicorn-50282.exe
2264	Unicorn-47018.exe
1096	Unicorn-26235.exe
988	Unicorn-57953.exe
2276	Unicorn-30873.exe
1548	Unicorn-19795.exe
1580	Unicorn-50739.exe
2764	Unicorn-13664.exe
2644	Unicorn-8289.exe
1640	Unicorn-54880.exe
2168	Unicorn-50064.exe
2192	Unicorn-37065.exe
1900	Unicorn-31318.exe
2096	Unicorn-62337.exe
2724	Unicorn-32959.exe
2880	Unicorn-52825.exe
2344	Unicorn-44392.exe
1736	Unicorn-36489.exe
2368	Unicorn-33535.exe
2384	Unicorn-47480.exe
2320	Unicorn-35550.exe
2104	Unicorn-43910.exe
2200	Unicorn-35550.exe
808	Unicorn-15108.exe
2280	Unicorn-26043.exe
1080	Unicorn-29035.exe
1952	Unicorn-27190.exe
2608	Unicorn-27190.exe
2440	Unicorn-28918.exe
2984	Unicorn-28918.exe
860	Unicorn-3452.exe
660	Unicorn-22787.exe
2632	Unicorn-12965.exe
2564	Unicorn-58637.exe
1516	Unicorn-58637.exe
2716	Unicorn-29494.exe
2692	Unicorn-29229.exe
2892	Unicorn-25135.exe
1808	Unicorn-13851.exe
692	Unicorn-5461.exe
2720	Unicorn-19271.exe
2876	Unicorn-32269.exe

Loads dropped DLL 64 IoCs

pid	Process
2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
2816	Unicorn-12139.exe
2816	Unicorn-12139.exe
2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
1668	Unicorn-6130.exe
1668	Unicorn-6130.exe
2816	Unicorn-12139.exe
2816	Unicorn-12139.exe
2864	Unicorn-62985.exe
2864	Unicorn-62985.exe
2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
2524	Unicorn-29369.exe
2524	Unicorn-29369.exe
1668	Unicorn-6130.exe
1668	Unicorn-6130.exe
1816	Unicorn-34007.exe
2816	Unicorn-12139.exe
1816	Unicorn-34007.exe
2816	Unicorn-12139.exe
1528	Unicorn-37729.exe
1528	Unicorn-37729.exe
2864	Unicorn-62985.exe
2864	Unicorn-62985.exe
1948	Unicorn-47935.exe
1948	Unicorn-47935.exe
2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
2172	Unicorn-37340.exe
2172	Unicorn-37340.exe
2180	Unicorn-16405.exe
2524	Unicorn-29369.exe
2180	Unicorn-16405.exe
2524	Unicorn-29369.exe
1668	Unicorn-6130.exe
1668	Unicorn-6130.exe
2856	Unicorn-47738.exe
2856	Unicorn-47738.exe
2092	Unicorn-14874.exe
2092	Unicorn-14874.exe
2516	Unicorn-53868.exe
2516	Unicorn-53868.exe
2816	Unicorn-12139.exe
2816	Unicorn-12139.exe
1816	Unicorn-34007.exe
1604	Unicorn-63956.exe
1816	Unicorn-34007.exe
1604	Unicorn-63956.exe
2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
1948	Unicorn-47935.exe
2360	Unicorn-47620.exe
2460	Unicorn-27754.exe
1948	Unicorn-47935.exe
2864	Unicorn-62985.exe
2360	Unicorn-47620.exe
2460	Unicorn-27754.exe
2864	Unicorn-62985.exe
1528	Unicorn-37729.exe
1528	Unicorn-37729.exe
2364	Unicorn-6945.exe
2364	Unicorn-6945.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3748	3560	WerFault.exe	225

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50388.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
2816	Unicorn-12139.exe
1668	Unicorn-6130.exe
2864	Unicorn-62985.exe
2524	Unicorn-29369.exe
1816	Unicorn-34007.exe
1528	Unicorn-37729.exe
1948	Unicorn-47935.exe
2172	Unicorn-37340.exe
2180	Unicorn-16405.exe
2856	Unicorn-47738.exe
2092	Unicorn-14874.exe
2516	Unicorn-53868.exe
2360	Unicorn-47620.exe
1604	Unicorn-63956.exe
2460	Unicorn-27754.exe
2364	Unicorn-6945.exe
1820	Unicorn-50609.exe
1588	Unicorn-21274.exe
2236	Unicorn-45377.exe
2064	Unicorn-62690.exe
2480	Unicorn-50355.exe
1868	Unicorn-50282.exe
2400	Unicorn-50547.exe
2264	Unicorn-47018.exe
2276	Unicorn-30873.exe
1096	Unicorn-26235.exe
988	Unicorn-57953.exe
1580	Unicorn-50739.exe
1548	Unicorn-19795.exe
2764	Unicorn-13664.exe
2644	Unicorn-8289.exe
1640	Unicorn-54880.exe
2168	Unicorn-50064.exe
2192	Unicorn-37065.exe
1900	Unicorn-31318.exe
2880	Unicorn-52825.exe
2344	Unicorn-44392.exe
1736	Unicorn-36489.exe
2368	Unicorn-33535.exe
2096	Unicorn-62337.exe
2724	Unicorn-32959.exe
2384	Unicorn-47480.exe
2320	Unicorn-35550.exe
2200	Unicorn-35550.exe
2104	Unicorn-43910.exe
808	Unicorn-15108.exe
1952	Unicorn-27190.exe
2608	Unicorn-27190.exe
2440	Unicorn-28918.exe
1080	Unicorn-29035.exe
2716	Unicorn-29494.exe
2984	Unicorn-28918.exe
2720	Unicorn-19271.exe
860	Unicorn-3452.exe
660	Unicorn-22787.exe
2280	Unicorn-26043.exe
1516	Unicorn-58637.exe
692	Unicorn-5461.exe
2632	Unicorn-12965.exe
2692	Unicorn-29229.exe
2892	Unicorn-25135.exe
1808	Unicorn-13851.exe
2564	Unicorn-58637.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2816	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	30
PID 2188 wrote to memory of 2816	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	30
PID 2188 wrote to memory of 2816	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	30
PID 2188 wrote to memory of 2816	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	30
PID 2816 wrote to memory of 1668	2816	Unicorn-12139.exe	31
PID 2816 wrote to memory of 1668	2816	Unicorn-12139.exe	31
PID 2816 wrote to memory of 1668	2816	Unicorn-12139.exe	31
PID 2816 wrote to memory of 1668	2816	Unicorn-12139.exe	31
PID 2188 wrote to memory of 2864	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	32
PID 2188 wrote to memory of 2864	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	32
PID 2188 wrote to memory of 2864	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	32
PID 2188 wrote to memory of 2864	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	32
PID 1668 wrote to memory of 2524	1668	Unicorn-6130.exe	33
PID 1668 wrote to memory of 2524	1668	Unicorn-6130.exe	33
PID 1668 wrote to memory of 2524	1668	Unicorn-6130.exe	33
PID 1668 wrote to memory of 2524	1668	Unicorn-6130.exe	33
PID 2816 wrote to memory of 1816	2816	Unicorn-12139.exe	34
PID 2816 wrote to memory of 1816	2816	Unicorn-12139.exe	34
PID 2816 wrote to memory of 1816	2816	Unicorn-12139.exe	34
PID 2816 wrote to memory of 1816	2816	Unicorn-12139.exe	34
PID 2864 wrote to memory of 1528	2864	Unicorn-62985.exe	35
PID 2864 wrote to memory of 1528	2864	Unicorn-62985.exe	35
PID 2864 wrote to memory of 1528	2864	Unicorn-62985.exe	35
PID 2864 wrote to memory of 1528	2864	Unicorn-62985.exe	35
PID 2188 wrote to memory of 1948	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	36
PID 2188 wrote to memory of 1948	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	36
PID 2188 wrote to memory of 1948	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	36
PID 2188 wrote to memory of 1948	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	36
PID 2524 wrote to memory of 2172	2524	Unicorn-29369.exe	37
PID 2524 wrote to memory of 2172	2524	Unicorn-29369.exe	37
PID 2524 wrote to memory of 2172	2524	Unicorn-29369.exe	37
PID 2524 wrote to memory of 2172	2524	Unicorn-29369.exe	37
PID 1668 wrote to memory of 2180	1668	Unicorn-6130.exe	38
PID 1668 wrote to memory of 2180	1668	Unicorn-6130.exe	38
PID 1668 wrote to memory of 2180	1668	Unicorn-6130.exe	38
PID 1668 wrote to memory of 2180	1668	Unicorn-6130.exe	38
PID 1816 wrote to memory of 2516	1816	Unicorn-34007.exe	39
PID 1816 wrote to memory of 2516	1816	Unicorn-34007.exe	39
PID 1816 wrote to memory of 2516	1816	Unicorn-34007.exe	39
PID 1816 wrote to memory of 2516	1816	Unicorn-34007.exe	39
PID 2816 wrote to memory of 2856	2816	Unicorn-12139.exe	40
PID 2816 wrote to memory of 2856	2816	Unicorn-12139.exe	40
PID 2816 wrote to memory of 2856	2816	Unicorn-12139.exe	40
PID 2816 wrote to memory of 2856	2816	Unicorn-12139.exe	40
PID 1528 wrote to memory of 2360	1528	Unicorn-37729.exe	41
PID 1528 wrote to memory of 2360	1528	Unicorn-37729.exe	41
PID 1528 wrote to memory of 2360	1528	Unicorn-37729.exe	41
PID 1528 wrote to memory of 2360	1528	Unicorn-37729.exe	41
PID 2864 wrote to memory of 2460	2864	Unicorn-62985.exe	42
PID 2864 wrote to memory of 2460	2864	Unicorn-62985.exe	42
PID 2864 wrote to memory of 2460	2864	Unicorn-62985.exe	42
PID 2864 wrote to memory of 2460	2864	Unicorn-62985.exe	42
PID 1948 wrote to memory of 1604	1948	Unicorn-47935.exe	43
PID 1948 wrote to memory of 1604	1948	Unicorn-47935.exe	43
PID 1948 wrote to memory of 1604	1948	Unicorn-47935.exe	43
PID 1948 wrote to memory of 1604	1948	Unicorn-47935.exe	43
PID 2188 wrote to memory of 2092	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	44
PID 2188 wrote to memory of 2092	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	44
PID 2188 wrote to memory of 2092	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	44
PID 2188 wrote to memory of 2092	2188	410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe	44
PID 2172 wrote to memory of 2364	2172	Unicorn-37340.exe	45
PID 2172 wrote to memory of 2364	2172	Unicorn-37340.exe	45
PID 2172 wrote to memory of 2364	2172	Unicorn-37340.exe	45
PID 2172 wrote to memory of 2364	2172	Unicorn-37340.exe	45

C:\Users\Admin\AppData\Local\Temp\410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe
"C:\Users\Admin\AppData\Local\Temp\410ea52265762690fa81b3c2c8e0d9af1f4669de8932ffdd0bc83440afb98767N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51362.exe
        9⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        9⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        9⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        9⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        8⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        9⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        10⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        11⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        11⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        11⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32537.exe
        10⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
        10⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        10⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13466.exe
        9⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exe
        9⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
        9⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        9⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        8⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exe
        9⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51199.exe
        9⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24945.exe
        9⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        9⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45428.exe
        8⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
        8⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
        8⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        8⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        7⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        8⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8801.exe
        9⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        9⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        9⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
        9⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
        8⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        8⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        8⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6119.exe
        7⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24573.exe
        7⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50064.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        7⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12164.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        8⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        7⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        7⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        6⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        7⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42876.exe
        7⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        6⤵
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        7⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        8⤵
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        8⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
        8⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45778.exe
        7⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
        8⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3298.exe
        8⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        8⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        7⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        6⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46273.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        6⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32537.exe
        6⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35967.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19690.exe
        5⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        6⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
        7⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
        5⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63176.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33392.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32315.exe
        6⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62789.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        5⤵
        
        PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62337.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        7⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23991.exe
        8⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        8⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
        8⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21037.exe
        7⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8801.exe
        8⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        8⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9738.exe
        8⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3055.exe
        7⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8429.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42274.exe
        6⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1602.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2785.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32959.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
        6⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2218.exe
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26633.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20699.exe
        8⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        8⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        8⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        7⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7542.exe
        6⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28158.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47460.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34699.exe
        7⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        7⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe
        5⤵
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21573.exe
        6⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6767.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52287.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64068.exe
        5⤵
        
        PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51535.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21108.exe
        6⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55750.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24788.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38181.exe
        6⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44844.exe
        5⤵
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2903.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22580.exe
        9⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51931.exe
        10⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        10⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        10⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe
        9⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        9⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        9⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42786.exe
        8⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
        8⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        8⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
        7⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64845.exe
        7⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8292.exe
        6⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20855.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60206.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18941.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42876.exe
        5⤵
        
        PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
        5⤵
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
        7⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-115.exe
        8⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53805.exe
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60939.exe
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        6⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exe
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        5⤵
        
        PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        5⤵
        
        PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4585.exe
      4⤵
      PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50025.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30416.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38763.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
      4⤵
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
      4⤵
      PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
      4⤵
      PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53868.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exe
        6⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37333.exe
        7⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        7⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39659.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15250.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26368.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34469.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        6⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        7⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
        6⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14307.exe
        7⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exe
        8⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        9⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        8⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        8⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47818.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        7⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-201.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35714.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        5⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        6⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        5⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32217.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-798.exe
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43910.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8658.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30669.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
        6⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56250.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18095.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        5⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65387.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        5⤵
        
        PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        5⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
      4⤵
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26633.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32895.exe
      4⤵
      PID:6548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62690.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36489.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30236.exe
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
        6⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        7⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15183.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        6⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36306.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38763.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22068.exe
        5⤵
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
      4⤵
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62911.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
      4⤵
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
      4⤵
      PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
      4⤵
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8269.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        5⤵
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
      4⤵
      PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
      4⤵
      PID:6932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
      4⤵
      PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-115.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38763.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exe
      4⤵
      PID:6080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38042.exe
    3⤵
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
      4⤵
      PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38763.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
      4⤵
      PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
      4⤵
      PID:6956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
    3⤵
    PID:3148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28698.exe
    3⤵
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
    3⤵
    PID:6540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37729.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47620.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59330.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12842.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5461.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exe
        6⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44245.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
        7⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32729.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe
        5⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        6⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13046.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4177.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe
        6⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
        7⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        5⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34853.exe
        6⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        6⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
        5⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
      4⤵
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44977.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65162.exe
      4⤵
      PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50739.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22201.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        6⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        5⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40300.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58637.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40519.exe
      4⤵
      PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57255.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
      4⤵
      PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13664.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12965.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
      4⤵
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        5⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31830.exe
      4⤵
      PID:3560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 236
        5⤵
        Program crash
        
        PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11510.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe
      4⤵
      PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
    3⤵
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37961.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18829.exe
      4⤵
      PID:6904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44207.exe
    3⤵
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
    3⤵
    PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
    3⤵
    PID:7084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26235.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40823.exe
        6⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61489.exe
        5⤵
        
        PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
        5⤵
        
        PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58637.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        5⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-115.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
        6⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65480.exe
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
      4⤵
      PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24824.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30046.exe
      4⤵
      PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49525.exe
        5⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        6⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exe
        7⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
        6⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39928.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42107.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34469.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        5⤵
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14228.exe
        5⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27764.exe
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12537.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
      4⤵
      PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31830.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
      4⤵
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34469.exe
      4⤵
      PID:6788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8801.exe
      4⤵
      PID:748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8608.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
    3⤵
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31262.exe
    3⤵
    PID:3696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
    3⤵
    PID:5268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14874.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14874.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32543.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34052.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10669.exe
      4⤵
      PID:712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46512.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
      4⤵
      PID:6480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16962.exe
      4⤵
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        5⤵
        
        PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48745.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
      4⤵
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40300.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
      4⤵
      PID:3024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
    3⤵
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52315.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
      4⤵
      PID:5572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe
    3⤵
    PID:6388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48373.exe
      4⤵
      PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18095.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
      4⤵
      PID:7076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
    3⤵
    PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56466.exe
      4⤵
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
      4⤵
      PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
    3⤵
    PID:2220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34469.exe
    3⤵
    PID:6744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
  2⤵
  PID:1772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
  2⤵
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
  2⤵
  PID:4420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
  2⤵
  PID:6060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14874.exe

Filesize
468KB

MD5
31f8fd095e18c6dfae337a726df78770

SHA1
0efa315f679824b82606c7b22e02f2aff886e13e

SHA256
728848576c7c4a8760d4faf8db287147f21077775e7ab693fe512f5d565cc5c5

SHA512
670de9d2d8676b548d4fe45d50fedb9513545e6d292698d1c61b7d8783e56158530610004aaa24012f1d2a59bb04c6565b6ddf8e874afd22cb5de7d00048b0bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47620.exe

Filesize
468KB

MD5
17fd2e9115eb6556b44bb66d4d83c01e

SHA1
fea57a72d93b2fe41d4b6c0d20c874bbec7ec093

SHA256
d988b26ce07d33beb5cd676109af3fbf0c3d4e71934fed68de9ad054fecf8897

SHA512
47d12eec4cec524b7ebca8d365bb3e4592e5421d1241113ae19b4f955847dc79664f99f493f3af279362e59faaee9979d13676f6020cc927a449526b2a90f4cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe

Filesize
468KB

MD5
e763aa72ebe76e0f6ab87c1b11983aec

SHA1
87de3c6fb95afcfebc8456df2e3ae43dbc1f8491

SHA256
522d1c9a1581d861551a4d9a84c40eee83c879470e5c2ce5a0cfa1134847376b

SHA512
dae7167650cf5f98cfc38fe06309877fb85e4fd52325ab96b596456a56e6fbf2f909757b8dbad67e525c2ead7b0b841e1422a96b376950e6f35695224e5c4628

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe

Filesize
468KB

MD5
7d3bbb718aca91ba4420d4fea6d64035

SHA1
9cefc383fedd815a6c80ab8658f07c6411095a6d

SHA256
39f9e1ed5ed437426c3d8539753481d7451cb5eada49bdad02536fa8959dfeb5

SHA512
cc6e791ec6c379b9e9c9c8af4953393fd6c9133768fe14a60818c2ede28a85afa51657c61a4ae2fbc34e38840030ec8f0031cd0efaa97204bf8de6db4116d207

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exe

Filesize
468KB

MD5
553741c36f6256b28a75da3775fb15e8

SHA1
2aa12875688be957bcd6789b5d0824e5143ce83f

SHA256
30a9b898c79ab4415f9cf08321d649382f96dcdb71ee7ff36e5d117646bff102

SHA512
f1ef70e4d16d747bc0e0be029acec2c59e21d3f915e958686e7b2dbc7f2c8ad45abb216a796c91a31f815fea6c1ab7b1d536413efc5d42d11b1a97901f01cfd6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe

Filesize
468KB

MD5
c76cd422bc4a482f5932a088929fa561

SHA1
5caf6df97405a910e1c58012249bbd8779aee132

SHA256
856c91114424bf4e2c07466812cfde96b2b5e10662fb90a2a2d07b10bcea228e

SHA512
1bb53f4d7744e011633972ebee024ee203be97ed63e44f3c584b654695c5c7abed71f05a3b279f1bb498c8b2e2db29f2cd81ae6a6addc94ec6c9e477f5655494

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe

Filesize
468KB

MD5
6b738ecbb9eda378aa6486c08d2a380f

SHA1
6c7447c6437fc0d54fa19756c30a325e36bb9ee6

SHA256
47b80e55c650b3110a43604af5d151beaf8847c5f1ed4f01c31374290005f576

SHA512
a4ce3836bf40da7523bee782aaedc25be33393a3797e3497e37e6ac6721d2a4f1d5bac9ee0d23cf41ca123b71078c1b2cc2f7b7c7bdb383aa7d4d108fa7d4dd7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe

Filesize
468KB

MD5
803c3f43e393fb11db3625dec53a9915

SHA1
96b1094e54002e5286bef45d675dd70ecfec0353

SHA256
0fbdfcf9ce429f26117cbead33cd5a76a36bb3121d0ab12c487764f4d31e3853

SHA512
e1f6d6c19bd252bba8a56c725e0df7a580faee9fd88b8df552811e79566c4ce9d304bf3798f06c7ad3b35ddf541eacec967a4136fd5d9c9681a518a92a3e0c3f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe

Filesize
468KB

MD5
ec8a8f9ec2ea0ab0218e916acb306a6c

SHA1
36b21e5a75d1b5940d340282c2310894e7801684

SHA256
04e9f4a9ae12a31f008a300662a0b95c9037130fc9c94d4c056e88beda981eaf

SHA512
6b43577bd15a9f71d3833826736a4fca0dd495efc3bb98dd63bca3d214e0c4929552a65ccc382ce25b00de00b6f1788c4dcab59f5f5d24f01cfab0cd18102581

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe

Filesize
468KB

MD5
a03c22b544c229911927511545df70f5

SHA1
d5a7ff13cf5a7d1325767eee5cd75ebf28368fcf

SHA256
a302256db20a32fc18cf4e4d19565c8cc450c4ac083bb8a40c83c8513d45c6d2

SHA512
6378d4255de48d95ba908caff3219688693fce1739044fe09a480274fd131fe965aa7b4d44b7a7cce701e8f1cbc60581b366317dc7d3050f3b5a0e80edbc0bb1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe

Filesize
468KB

MD5
c11a74252ea2d164e1c773d807f19d7d

SHA1
0c36b80f478d4b3f97502fb6e361fed075eec624

SHA256
92e96f0f442cf112e37c396db3e105adad7a366c295f33ce8dacfcb37611f28d

SHA512
428ea66ed5ec7d8e2e80ad5985468f705b4e0afffd841b2060757a6b8ae2da3c0d8431dbeaed9c2bc5e7ab51fb326672653b69d64c1cd3774a915a7366ec78ab

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe

Filesize
468KB

MD5
f910abbb62c623959909872800fdd864

SHA1
0b41b81b083e76b3da5060bcaa69fc3bbaad659f

SHA256
12ba531c50a1e72cc904f144d5c1e65f7a368f0c35becad88378e9087bc6cfe4

SHA512
47edd2e587e926b81648f08f01413e399a3b9d065feb2eed7df904d1caf5bdbfd80b4f256c6fe0e85582c712ade01adf03e7ba91f3779befc9f609229e116268

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37729.exe

Filesize
468KB

MD5
d4250fa415ef90cbdf0a2db423ac47e3

SHA1
81e28a4c193527dc4de836b25ff60e135b51eb53

SHA256
337d2f9c74763ab4d381c9fe236a01456a1e042f51a2e7ff7d856e2289becf56

SHA512
ba481d38a005fd81103d8ba9a28666c9fd775e8c3e6610cfcf3ad0a77623f81fd3fc30b96090d1f18557adbf081ce6014f1db96e28ceff3b7acdc596deb7ce32

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47738.exe

Filesize
468KB

MD5
99796da247966b05a6e3e72526bf1534

SHA1
f40f378d1892e60a4654894b3ff2ab13493173fb

SHA256
746ef8107dd1235e58ff16b6bef69cbde3cc975624acd3434d70fc569f2b44cf

SHA512
c881997aae418bae8b0417e93f071bac34efd03e11796a30a395e262ef818ae89edea19a2ee2f1b526105d72b7bb70982411df62b0991b89bcc5337517eaf1ad

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe

Filesize
468KB

MD5
0c947e8c57200344a13260cc367599ba

SHA1
1eac8980fa82f50465009685bb11ddd0e09f61d8

SHA256
56ebda0bebb9edb178bb1fcbbdebe9db3c5db4356d23523d4d0d371ddfbd6d9c

SHA512
43e6b40d9442ff4215686b72b798dd66abae8fca6e3c649a0691a57b14657a9c76caeca90667421bcdc0b471344a92b400e1bec5a84124b2bafa3852e2e7ba2b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53868.exe

Filesize
468KB

MD5
600a19d7296e7383ecca0ecd5e6c6e1e

SHA1
c1b49693f7e8a32c71c6b2452a44023637f03289

SHA256
0e88f346c5507c942f6086854e897aa58051359e4f7acdbee844694e2b7d81ad

SHA512
63a015010198a7e013064b03af7c0ccbb9501f0de1d2ef7d11f9da05940cc92c58c706ca4c4de932ab834e590dcf37da71e66540906ae0a14cb61cf270f4873d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe

Filesize
468KB

MD5
94701495ad98dc4f6b332bde6a8f4d13

SHA1
3b901e3de9ed760ff1805bc41a5cf6e32cceff02

SHA256
1d1e2f024d0db7bd4389d0771b6bce00ce91603810d61cfe2936db71b8797299

SHA512
7f1afb3ad561168c56b9e1ca2f3789b777bc3eaf0d36a06827e96faf12f121eb0ff2e1f921518706ff277ce6ff6fd8ef87ab224eec4596792cbc5bdd7dd30870

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe

Filesize
468KB

MD5
f5e9f91ce6acb1ee2c5dc9fb2d4416a6

SHA1
33d472b554cb6bad7489e28edde18974130ddd58

SHA256
f71aae64dc8af4a7372bcd8defea2804957d1c409f7e5d2a3fcf292d2762ea27

SHA512
d3c788644097f8d4bb0ad18d21dfbbf7a339a7bad5282a7113574898190a2d42c926bf9ad75de803d6151f059d0c9f1292e82a21adcfb7a99e4ed9cf41782849

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe

Filesize
468KB

MD5
1bba6f845009e3abe8240c31d18ca93f

SHA1
036c4585f6e2c89e7f2db3f5426ee6bf24aa84a6

SHA256
5b715bc3558e50204ded2118841243a72d80457965e2c33232717b5772c6d556

SHA512
785a8faaff8e49ad76c77a5aed2b76b338dd8d6755efb475cdeef0f1c1c01c20f3e46dd5437d9b7e78d7d048f4bd21a3a65bdc0c5bb25f42bded9c8c3ad8701c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe

Filesize
468KB

MD5
3e3089786d7866d193e04745a6cc80d7

SHA1
a27d70e5b3943defcac83fba4bdd9d7886939721

SHA256
836854d9e3d8c946286f1766b21a5371f8be878a5964ac9f1564a17216fc12b7

SHA512
6c8cd151fdb548f7ce4f66db4873d3bba7690adcbbbe6737512558b7fa95fb84d3e1514655c2a614df50ed04284f2bfa0813138759affadf80971f91e86348c0

Download Submit
memory/988-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1096-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-341-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/1528-340-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/1528-141-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/1528-140-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/1548-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-397-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1588-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-287-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/1604-288-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/1640-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1668-430-0x0000000002C00000-0x0000000002C75000-memory.dmp

Filesize
468KB

Download
memory/1668-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1668-233-0x0000000003730000-0x00000000037A5000-memory.dmp

Filesize
468KB

Download
memory/1668-237-0x0000000002C00000-0x0000000002C75000-memory.dmp

Filesize
468KB

Download
memory/1668-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-280-0x0000000002C90000-0x0000000002D05000-memory.dmp

Filesize
468KB

Download
memory/1816-123-0x0000000002C90000-0x0000000002D05000-memory.dmp

Filesize
468KB

Download
memory/1816-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1820-382-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1820-384-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1820-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1948-172-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/1948-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1948-158-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/1948-331-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/1948-307-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2064-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2092-256-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2092-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2092-255-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2096-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-197-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2172-196-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2172-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-375-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2180-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2180-221-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2180-223-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2180-410-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2188-175-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2188-174-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2188-11-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2188-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-5-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2188-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-303-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2188-304-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2192-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-416-0x0000000002C80000-0x0000000002CF5000-memory.dmp

Filesize
468KB

Download
memory/2236-414-0x0000000002C80000-0x0000000002CF5000-memory.dmp

Filesize
468KB

Download
memory/2264-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-334-0x0000000001DF0000-0x0000000001E65000-memory.dmp

Filesize
468KB

Download
memory/2360-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-329-0x0000000001DF0000-0x0000000001E65000-memory.dmp

Filesize
468KB

Download
memory/2364-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-363-0x00000000037A0000-0x0000000003815000-memory.dmp

Filesize
468KB

Download
memory/2364-364-0x0000000002C70000-0x0000000002CE5000-memory.dmp

Filesize
468KB

Download
memory/2400-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-330-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2460-336-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2460-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-266-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2516-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-393-0x00000000037E0000-0x0000000003855000-memory.dmp

Filesize
468KB

Download
memory/2524-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-222-0x00000000035E0000-0x0000000003655000-memory.dmp

Filesize
468KB

Download
memory/2524-224-0x00000000035E0000-0x0000000003655000-memory.dmp

Filesize
468KB

Download
memory/2644-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-274-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2816-275-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2816-25-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2816-24-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2816-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-124-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2856-245-0x0000000002C90000-0x0000000002D05000-memory.dmp

Filesize
468KB

Download
memory/2856-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-246-0x0000000002C90000-0x0000000002D05000-memory.dmp

Filesize
468KB

Download
memory/2864-151-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2864-150-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2864-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-333-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2864-338-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2880-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download