87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbea

Analysis

max time kernel
119s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
Size

468KB
MD5

a3945c3962a8520ebe1dfa508c5b3a00
SHA1

54300f0acd75fd6796cb92cc609f029528c487f3
SHA256

87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbea
SHA512

e960ff313b678d26c339caded48813109d13dd6ec3f4cf6f45cabdd919d725c1cb0c0e2bd91d894f6ece7a8b40a3c396e53b47bb962d903c6d8f243c278c5606
SSDEEP

3072:qG3KogIKI05UtbY3HzZOcf8/zChaP0ponZHewYPUrP5L9W+TEslud:qGaoD8Ut4HlOcfuY72rPV4+TE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1400	Unicorn-16695.exe
2740	Unicorn-49144.exe
2724	Unicorn-61951.exe
2840	Unicorn-29129.exe
2520	Unicorn-12984.exe
2764	Unicorn-25983.exe
3004	Unicorn-15214.exe
1228	Unicorn-26637.exe
2940	Unicorn-4977.exe
2508	Unicorn-3368.exe
2896	Unicorn-61002.exe
1380	Unicorn-16440.exe
548	Unicorn-38920.exe
520	Unicorn-57167.exe
1908	Unicorn-11495.exe
2316	Unicorn-13808.exe
1484	Unicorn-10810.exe
560	Unicorn-43867.exe
1320	Unicorn-43602.exe
1368	Unicorn-19555.exe
2156	Unicorn-46097.exe
940	Unicorn-52508.exe
360	Unicorn-44910.exe
1668	Unicorn-58293.exe
2324	Unicorn-12621.exe
2680	Unicorn-15916.exe
1112	Unicorn-37017.exe
1916	Unicorn-55600.exe
1136	Unicorn-9928.exe
2204	Unicorn-61359.exe
860	Unicorn-25689.exe
1592	Unicorn-49243.exe
2656	Unicorn-8859.exe
2728	Unicorn-39922.exe
2592	Unicorn-25279.exe
2476	Unicorn-28769.exe
2504	Unicorn-35559.exe
2636	Unicorn-10285.exe
1252	Unicorn-19607.exe
3012	Unicorn-32605.exe
2372	Unicorn-44303.exe
2268	Unicorn-2310.exe
1028	Unicorn-47105.exe
808	Unicorn-26244.exe
1924	Unicorn-25938.exe
564	Unicorn-25938.exe
2692	Unicorn-44578.exe
2976	Unicorn-8376.exe
1792	Unicorn-27977.exe
2272	Unicorn-31920.exe
604	Unicorn-35450.exe
1420	Unicorn-46232.exe
2124	Unicorn-25274.exe
1800	Unicorn-25274.exe
2420	Unicorn-60940.exe
1728	Unicorn-15268.exe
2140	Unicorn-9138.exe
1852	Unicorn-36819.exe
1248	Unicorn-34101.exe
1544	Unicorn-94.exe
2648	Unicorn-16312.exe
752	Unicorn-20950.exe
1528	Unicorn-50904.exe
2224	Unicorn-26976.exe

Loads dropped DLL 64 IoCs

pid	Process
3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
1400	Unicorn-16695.exe
3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
1400	Unicorn-16695.exe
3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
2740	Unicorn-49144.exe
2740	Unicorn-49144.exe
2724	Unicorn-61951.exe
2724	Unicorn-61951.exe
1400	Unicorn-16695.exe
1400	Unicorn-16695.exe
3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
1372	WerFault.exe
1372	WerFault.exe
1372	WerFault.exe
1372	WerFault.exe
2740	Unicorn-49144.exe
2740	Unicorn-49144.exe
2520	Unicorn-12984.exe
2520	Unicorn-12984.exe
2764	Unicorn-25983.exe
3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
2724	Unicorn-61951.exe
2764	Unicorn-25983.exe
3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
2724	Unicorn-61951.exe
1400	Unicorn-16695.exe
1400	Unicorn-16695.exe
1372	WerFault.exe
3004	Unicorn-15214.exe
1228	Unicorn-26637.exe
3004	Unicorn-15214.exe
1228	Unicorn-26637.exe
2740	Unicorn-49144.exe
2740	Unicorn-49144.exe
548	Unicorn-38920.exe
548	Unicorn-38920.exe
1380	Unicorn-16440.exe
1380	Unicorn-16440.exe
1400	Unicorn-16695.exe
1400	Unicorn-16695.exe
2508	Unicorn-3368.exe
2508	Unicorn-3368.exe
2724	Unicorn-61951.exe
2724	Unicorn-61951.exe
3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
2940	Unicorn-4977.exe
2940	Unicorn-4977.exe
2520	Unicorn-12984.exe
2896	Unicorn-61002.exe
2520	Unicorn-12984.exe
2896	Unicorn-61002.exe
2764	Unicorn-25983.exe
2764	Unicorn-25983.exe
1908	Unicorn-11495.exe
1908	Unicorn-11495.exe
1228	Unicorn-26637.exe
1228	Unicorn-26637.exe
520	Unicorn-57167.exe
520	Unicorn-57167.exe
3004	Unicorn-15214.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	2840	WerFault.exe	33

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31166.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
1400	Unicorn-16695.exe
2724	Unicorn-61951.exe
2740	Unicorn-49144.exe
2840	Unicorn-29129.exe
2764	Unicorn-25983.exe
3004	Unicorn-15214.exe
2520	Unicorn-12984.exe
1228	Unicorn-26637.exe
548	Unicorn-38920.exe
2940	Unicorn-4977.exe
2896	Unicorn-61002.exe
2508	Unicorn-3368.exe
1380	Unicorn-16440.exe
520	Unicorn-57167.exe
1908	Unicorn-11495.exe
2316	Unicorn-13808.exe
1484	Unicorn-10810.exe
560	Unicorn-43867.exe
1368	Unicorn-19555.exe
1320	Unicorn-43602.exe
2156	Unicorn-46097.exe
1668	Unicorn-58293.exe
360	Unicorn-44910.exe
940	Unicorn-52508.exe
2324	Unicorn-12621.exe
2680	Unicorn-15916.exe
1916	Unicorn-55600.exe
1112	Unicorn-37017.exe
1136	Unicorn-9928.exe
2204	Unicorn-61359.exe
860	Unicorn-25689.exe
1592	Unicorn-49243.exe
2656	Unicorn-8859.exe
2728	Unicorn-39922.exe
2476	Unicorn-28769.exe
2592	Unicorn-25279.exe
2504	Unicorn-35559.exe
1252	Unicorn-19607.exe
2636	Unicorn-10285.exe
2372	Unicorn-44303.exe
2268	Unicorn-2310.exe
1028	Unicorn-47105.exe
564	Unicorn-25938.exe
808	Unicorn-26244.exe
3012	Unicorn-32605.exe
1924	Unicorn-25938.exe
2692	Unicorn-44578.exe
1792	Unicorn-27977.exe
2976	Unicorn-8376.exe
2272	Unicorn-31920.exe
604	Unicorn-35450.exe
2124	Unicorn-25274.exe
1420	Unicorn-46232.exe
1800	Unicorn-25274.exe
2420	Unicorn-60940.exe
1728	Unicorn-15268.exe
2140	Unicorn-9138.exe
1852	Unicorn-36819.exe
1248	Unicorn-34101.exe
752	Unicorn-20950.exe
1544	Unicorn-94.exe
2648	Unicorn-16312.exe
1528	Unicorn-50904.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1400	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	30
PID 3064 wrote to memory of 1400	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	30
PID 3064 wrote to memory of 1400	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	30
PID 3064 wrote to memory of 1400	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	30
PID 1400 wrote to memory of 2740	1400	Unicorn-16695.exe	31
PID 1400 wrote to memory of 2740	1400	Unicorn-16695.exe	31
PID 1400 wrote to memory of 2740	1400	Unicorn-16695.exe	31
PID 1400 wrote to memory of 2740	1400	Unicorn-16695.exe	31
PID 3064 wrote to memory of 2724	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	32
PID 3064 wrote to memory of 2724	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	32
PID 3064 wrote to memory of 2724	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	32
PID 3064 wrote to memory of 2724	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	32
PID 2740 wrote to memory of 2840	2740	Unicorn-49144.exe	33
PID 2740 wrote to memory of 2840	2740	Unicorn-49144.exe	33
PID 2740 wrote to memory of 2840	2740	Unicorn-49144.exe	33
PID 2740 wrote to memory of 2840	2740	Unicorn-49144.exe	33
PID 2724 wrote to memory of 2520	2724	Unicorn-61951.exe	34
PID 2724 wrote to memory of 2520	2724	Unicorn-61951.exe	34
PID 2724 wrote to memory of 2520	2724	Unicorn-61951.exe	34
PID 2724 wrote to memory of 2520	2724	Unicorn-61951.exe	34
PID 1400 wrote to memory of 2764	1400	Unicorn-16695.exe	35
PID 1400 wrote to memory of 2764	1400	Unicorn-16695.exe	35
PID 1400 wrote to memory of 2764	1400	Unicorn-16695.exe	35
PID 1400 wrote to memory of 2764	1400	Unicorn-16695.exe	35
PID 3064 wrote to memory of 3004	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	36
PID 3064 wrote to memory of 3004	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	36
PID 3064 wrote to memory of 3004	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	36
PID 3064 wrote to memory of 3004	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	36
PID 2840 wrote to memory of 1372	2840	Unicorn-29129.exe	37
PID 2840 wrote to memory of 1372	2840	Unicorn-29129.exe	37
PID 2840 wrote to memory of 1372	2840	Unicorn-29129.exe	37
PID 2840 wrote to memory of 1372	2840	Unicorn-29129.exe	37
PID 2740 wrote to memory of 1228	2740	Unicorn-49144.exe	38
PID 2740 wrote to memory of 1228	2740	Unicorn-49144.exe	38
PID 2740 wrote to memory of 1228	2740	Unicorn-49144.exe	38
PID 2740 wrote to memory of 1228	2740	Unicorn-49144.exe	38
PID 2520 wrote to memory of 2940	2520	Unicorn-12984.exe	39
PID 2520 wrote to memory of 2940	2520	Unicorn-12984.exe	39
PID 2520 wrote to memory of 2940	2520	Unicorn-12984.exe	39
PID 2520 wrote to memory of 2940	2520	Unicorn-12984.exe	39
PID 2764 wrote to memory of 2896	2764	Unicorn-25983.exe	40
PID 2764 wrote to memory of 2896	2764	Unicorn-25983.exe	40
PID 2764 wrote to memory of 2896	2764	Unicorn-25983.exe	40
PID 2764 wrote to memory of 2896	2764	Unicorn-25983.exe	40
PID 2724 wrote to memory of 1380	2724	Unicorn-61951.exe	42
PID 2724 wrote to memory of 1380	2724	Unicorn-61951.exe	42
PID 2724 wrote to memory of 1380	2724	Unicorn-61951.exe	42
PID 2724 wrote to memory of 1380	2724	Unicorn-61951.exe	42
PID 3064 wrote to memory of 2508	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	41
PID 3064 wrote to memory of 2508	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	41
PID 3064 wrote to memory of 2508	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	41
PID 3064 wrote to memory of 2508	3064	87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe	41
PID 1400 wrote to memory of 548	1400	Unicorn-16695.exe	43
PID 1400 wrote to memory of 548	1400	Unicorn-16695.exe	43
PID 1400 wrote to memory of 548	1400	Unicorn-16695.exe	43
PID 1400 wrote to memory of 548	1400	Unicorn-16695.exe	43
PID 3004 wrote to memory of 520	3004	Unicorn-15214.exe	44
PID 3004 wrote to memory of 520	3004	Unicorn-15214.exe	44
PID 3004 wrote to memory of 520	3004	Unicorn-15214.exe	44
PID 3004 wrote to memory of 520	3004	Unicorn-15214.exe	44
PID 1228 wrote to memory of 1908	1228	Unicorn-26637.exe	45
PID 1228 wrote to memory of 1908	1228	Unicorn-26637.exe	45
PID 1228 wrote to memory of 1908	1228	Unicorn-26637.exe	45
PID 1228 wrote to memory of 1908	1228	Unicorn-26637.exe	45

C:\Users\Admin\AppData\Local\Temp\87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe
"C:\Users\Admin\AppData\Local\Temp\87757ce4bfdc9dc00a9d11bc4c0d92e09ddc2d75640810c92e2450092562fbeaN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 240
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11495.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        8⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
        9⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        9⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        9⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        9⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        9⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        8⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        8⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        8⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        8⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15271.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50016.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60940.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe
        7⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
        8⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        8⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        7⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47723.exe
        7⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8760.exe
        7⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        6⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
        7⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe
        7⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        7⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2512.exe
        7⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        6⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51121.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
        6⤵
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14855.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35450.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46906.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        8⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        8⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        8⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        8⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        7⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15050.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11784.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51856.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46232.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        6⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        6⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
        6⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
        5⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
        6⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        6⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        5⤵
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1754.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25689.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe
        7⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        7⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        7⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
        7⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53122.exe
        7⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
        7⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        6⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26132.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39720.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58708.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        5⤵
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27921.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        5⤵
        
        PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49243.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26976.exe
        5⤵
        Executes dropped EXE
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        5⤵
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23218.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
        5⤵
        
        PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40521.exe
      4⤵
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        5⤵
        
        PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
      4⤵
      PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9481.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30332.exe
      4⤵
      PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12621.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
        7⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        7⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        6⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19328.exe
        6⤵
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15271.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        6⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        6⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23410.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
        6⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
        5⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        5⤵
        
        PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11106.exe
        6⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57721.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19320.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54557.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36702.exe
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9138.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39921.exe
        5⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60724.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44432.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        5⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        5⤵
        
        PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
      4⤵
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
      4⤵
      PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31248.exe
      4⤵
      PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38920.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10810.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        6⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64543.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11217.exe
        6⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        5⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61200.exe
        6⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        5⤵
        
        PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
        5⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26779.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
      4⤵
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
      4⤵
      PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2310.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44846.exe
        6⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60624.exe
        7⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49426.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        5⤵
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55291.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20055.exe
      4⤵
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        5⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        5⤵
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
      4⤵
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5322.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        5⤵
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31467.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
      4⤵
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
      4⤵
      PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
      4⤵
      PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
    3⤵
    PID:1460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48971.exe
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe
    3⤵
    PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35671.exe
    3⤵
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
    3⤵
    PID:6024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44910.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19607.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
        7⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3863.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22754.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
        7⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36510.exe
        7⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49056.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36386.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32605.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47866.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31538.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19019.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        6⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4435.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        5⤵
        
        PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        6⤵
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9867.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        5⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
      4⤵
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55054.exe
      4⤵
      PID:736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14855.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43867.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44303.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        6⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37050.exe
        5⤵
        
        PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12972.exe
        5⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
        6⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49426.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        6⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22668.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55291.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        5⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
      4⤵
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52364.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        5⤵
        
        PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55971.exe
      4⤵
      PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        5⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7074.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
      4⤵
      PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
      4⤵
      PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27977.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
      4⤵
      PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
      4⤵
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46827.exe
    3⤵
    PID:3964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14855.exe
    3⤵
    PID:5004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13698.exe
    3⤵
    PID:5360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15214.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15214.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        5⤵
        
        PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58644.exe
      4⤵
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        5⤵
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18071.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35445.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
      4⤵
      PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
      4⤵
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15271.exe
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
      4⤵
      PID:5764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34101.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-215.exe
        5⤵
        
        PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
      4⤵
      PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23218.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
      4⤵
      PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-94.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-94.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
    3⤵
    PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
    3⤵
    PID:6080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        5⤵
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        5⤵
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        5⤵
        
        PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52230.exe
      4⤵
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24158.exe
        5⤵
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31865.exe
        5⤵
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13552.exe
      4⤵
      PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
      4⤵
      PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19320.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40564.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20394.exe
      4⤵
      PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58492.exe
      4⤵
      PID:812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
      4⤵
      PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
    3⤵
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23212.exe
    3⤵
    PID:4000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19320.exe
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12142.exe
    3⤵
    PID:5532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
      4⤵
      PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24158.exe
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31865.exe
      4⤵
      PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44311.exe
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
    3⤵
    PID:3816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
    3⤵
    PID:3776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
    3⤵
    PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
    3⤵
    PID:5376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10285.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10285.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39729.exe
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
    3⤵
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
    3⤵
    PID:1076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
    3⤵
    PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
    3⤵
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
    3⤵
    PID:5736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56684.exe
  2⤵
  PID:2388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21101.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21101.exe
  2⤵
  PID:1988
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
  2⤵
  PID:3212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
  2⤵
  PID:4320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7935.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7935.exe
  2⤵
  PID:4564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
  2⤵
  PID:5924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe

Filesize
468KB

MD5
fe99ff3c6332ce708cead4f693fb8a56

SHA1
487e727c02b844935083a537f294bcaaf5bd6eb9

SHA256
29b88fb33c455a9356b799a32cb21b96026793c152adad87c962b730f4f3d171

SHA512
df3d6d1744e7c31d73ef88b71bf047bb64e7db4536750a9a583dc377c11f0f0f2b5c81a9176088b513ffa9d8f448c6f15390cdd3d2e15b5a729e9130f59c8210

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe

Filesize
468KB

MD5
c9a94928dfe1b110ce792168cd08b085

SHA1
44c4748be4adaa754b344b8bd7dae531c9e3b807

SHA256
7c358d09a2bdebe275d2c2f89af4c7ddf704fe52193bad904a6264dd806c7a94

SHA512
3fd96fd125df999f972116bd8cf216850949161cf9cac9bc7e79bea2f3d1a4cc9618853d5aafc1da5994a8a9c88243350bd491ba288c33ee367e6e63e347fbec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe

Filesize
468KB

MD5
e016d2b5c72b04426d85ef5eb9cf1180

SHA1
3d7b58d7913b24377274fd1dbbdc0ad62b63490e

SHA256
d2d131142dc45a05a3d3e277e61d447284d1d478f0ffeae983724fe592c951e5

SHA512
23f940de8c090d2774c5dd69f3758c4420b22f4f3bdba1e6e0797aca9e24741d484dd0d9f1507972b06eba75f49332ff18387e73d3e836993e5b1d8707493268

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50016.exe

Filesize
468KB

MD5
ffc37a984cc72c07484bf45927bea708

SHA1
851b570191e160d46e17972bfabb12e133d36a45

SHA256
97d4a9d64e9513980db0737bc6c6912d702355702db3b375c63954a9b20a963f

SHA512
af85d63453a6eec62a33a495449bd7ff1410c1c3c45d7b9c6342d49e8cc6511b1af1cabf0704de0747179b294f435e19ed7ea5220463914b1b2a5a943d2cb712

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe

Filesize
468KB

MD5
943fd6bb155a695f79b07e125d8ba83f

SHA1
25e2a2a01fecb1957ab7d8c68b8cfec5cc818ddb

SHA256
d2f86eb107c9f888d585da65dd3374c840e2cd8c5aa1fb8e4983d32e5c7e5d6e

SHA512
af0b18c9e0ad7ad80252a8d97e369be327c02d0e08af525fbab5cc39bfcfb100278fbb95e0cf75d4cbd6ddb59d7683af352adaf59c0691986bacad2cfe7c6bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe

Filesize
468KB

MD5
63b952ebb29021e976f60ae18578b578

SHA1
2d7ba318d8ee94642e906ef4e47e4f44faa71fb6

SHA256
66311f71b3ed62fed79a531c5b0015862c486719331d8462ee24a239ca2a1c47

SHA512
2909f1a02c7a97f524dc30df8438a4989fe16cd9de191ad279352ef65b29e7193398b32370f9b8968e443a867d9c2efccca79b5cb51a3ae39c70890ba64520ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe

Filesize
468KB

MD5
60c9f91cb3d58cb43b92df37e834fc2e

SHA1
65aa33a2b3b627c35d05b3fba3cb955e9b690c0b

SHA256
16a40722fb0435a84b756a9bad33e76f9a7a5dec4f234fb3f5ac3cc1b2f2f6bf

SHA512
f7ad4a7c84926abe73a36ed7d3f524db7bd672c60adb4278a3e8e19f8f0fe31b51e2aa0f386b85c437168490cfe803658fbaabb90a327b01a88c31871015bba0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10810.exe

Filesize
468KB

MD5
9ab06bd5f94613ff53ef0380322472b7

SHA1
c04ab0122f35538ce7631b56e826172a54c6483a

SHA256
4da5b86bab4fef30b9ddda4dfcd8da79955b6d07b2797553f4b1914292374655

SHA512
7d1c0ea0024ebd07d5b33a7424f4a5ba45fc89abc5cc3c1ce0b7d350c814e125e27dcde8a8bb8de143f71ce7fd2f96068cb442f46d761774967f8aef9100340a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11495.exe

Filesize
468KB

MD5
f15c6cc03ac22682c12287ccf640c711

SHA1
7161b742d7f12c4dd8d00de22d3bb10770f4bf16

SHA256
613d4ead462159ff93403b24d82614ec9b03a1b62bf9b8a97c85519d54fd7765

SHA512
01089728e9a65873ea13bb5e2196c457f89d1c2f4e6a03c82cd76463de61f159408793805f199b65f2fd03f41aaba8e6d916765c0d2480c52ef5a3006344b623

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe

Filesize
468KB

MD5
09823ebcbfaaecb0600819960e02b583

SHA1
92cab5c55f2224441e3ceb6c4e82fd0be2e1aa75

SHA256
1b744c0ea3e1e2025db699325059619fb90048793f5ecc148447346d258128ef

SHA512
689c8a87bef2df72387b3a099134693382986279524aebde70f844a95af1377d4c5387b40219480f3cf1c99f79a1f4ddd0ca2303cba7083159711bd1b477f7fa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15214.exe

Filesize
468KB

MD5
8aa5fe17e1c2c8df15fa8959debc4510

SHA1
486b0660d7f227e18f782ced2b87e2173de3e581

SHA256
8af2d9bde30b06f3cb3ff630615feec7d68e14f44273237d5e93e11cc1628f74

SHA512
d2d5c56d361c51f22985fcbeefd079d9a137be581b46e1e1a3836ea5f0cc7071264d42c5592a7876424c5ae7a9763f2f8051e1ddd42b49b816068e43ad249bf4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe

Filesize
468KB

MD5
428983714ae77e5a19a03d9d3e72db75

SHA1
c503d44c48470ccf764f8b6c285fd6923805a4c2

SHA256
b9ed7f858a257ffde1b68ad9d57410402c32ef1fed1af3d77e9614a49f2f763c

SHA512
b9c85b67786272257e1ae1b789b6694cb0f7f78e5525a10b6d4e63ff0e961b2d06283915c3838710c19e0347c1fe4b5999cee5d2b708511c5fd4b4313864e6ba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe

Filesize
468KB

MD5
ffbd6ac4a0af01d00cb4d79b3408da75

SHA1
6a6a73b0bd268b0f7b6628f4933bcfebe8c04baf

SHA256
6025d0f99895ed8d0d28b2cc7f82ff67a361c9de4ba123ae3f38edeb98468ee9

SHA512
3c67719b30970d36186b70d3156020146cc2ffde2d486bab4e2dbf388fd09b078379f41a21acba5ee4f5ddb00192955578fe0e3ad2d16435d194bc58bcce4642

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe

Filesize
468KB

MD5
205612b06aa28a8230e746695a940b0a

SHA1
71b2374bf9d817a85adf5826a6fc2d11394103b0

SHA256
df7f2c81e81b14852a9a5ff0d2be8dae4315b9b1e8c7f11948b9f6638cf51bba

SHA512
79f0385f24415fd597c03a9c010790509f1aa1dfd2a796d66c8be0e24dad2dfeb94d079b91010a295c19e5c02ddca0b25fff92b0cf9d70dd6e02aa77fc05e818

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe

Filesize
468KB

MD5
f3507a8cdbc45e15aed8515126c80e57

SHA1
7e982844ea51de9e5c5919680b069ccc6f36c0bc

SHA256
aeb516d742fdc0c2de67e44c367a5010ca03640cb51605367fa5a28255002788

SHA512
39df38ec9b5e67b8712929b25efe3794e603311f6de6c853d2756a58f4a3fc005514bc7765ee2e1bdf7aa9b0893cd97f7433a648f02f02f8b5fce52378ea5637

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe

Filesize
468KB

MD5
0a0bc8d5eb18c6d4ce4b4df8d43c8186

SHA1
d81f75c3da049a5925cb3fb72926fb7f509ba8b4

SHA256
b8746f2f7ccee76d21707239ef1cdfc897d81d84449e7fb4a6ba5a43b253bcfc

SHA512
f187b9677021619ac968f67d86f9f3eef201db90dbea291764730005adc861ee42f0cb1c54d24f12450318c59e2ef944672a96d062ebd5af72be4b48faccfdcf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe

Filesize
468KB

MD5
30ec4f1ba1ded93aa2ba0193e4f2d39a

SHA1
7a88598295cfdca81c19912bcca6c92e93d7e131

SHA256
ad791458e44ffa74403d88ee8d2673a1cf954939229b3fb9fe8fa9541d67184a

SHA512
84f4654038b1cfc298e473fc9e13c9732af0e1f350a1d3e03f2cd9fc3e2b314107316452cb76b02c9636e71d157ace96ba21f6b3eba42b3a8c3627e2ed91bebb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38920.exe

Filesize
468KB

MD5
0a732e88127b895207c60d00ae97ec28

SHA1
99804bbab2b9914da78c7b9e71256aa3e289fe30

SHA256
86ca08d9d9f4331fc97965db41e12a22d96cb630f476dafb99efbc616d0a053e

SHA512
955fccb7478cf8da173db86355061ee8558ad618291411ad178e0059191355aa44dc4868f5b7570389cc4ec725e335752197c9fbbd7e3ced81a0a2e49239a555

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe

Filesize
468KB

MD5
0fbdf085851918efa2a0756c439e12b2

SHA1
eed96f6838db40e000e88b94c93c86521f670ae3

SHA256
8a152e1d5f19fc8fc849218f7151863dab16cfee608015694b22de1a622e4692

SHA512
a56a921b5f6393b48fbfb96bfae150080ef450a96bf71e22a2e3c7ee61b58323a39322de36da3f527609726de9c80bad6093c150b5eab6e82297cb330182e46b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe

Filesize
468KB

MD5
a1cce636a1158dc69984efe24804dcaa

SHA1
c16f5ae091ad5bb5dd4b3a2e46054456291a1e7b

SHA256
17520c0e51b67bc356f29c644060e21fb43a9d70200f4bb64d2be0682b595522

SHA512
c0109cab0dd65cd37faaab986b12b4f152beb859d883f67842b2730e4c85de7ef5a676a214f0b2994a452a3db5435605bf6f988b8d28e88ca2a3f795e83a4f82

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe

Filesize
468KB

MD5
438453d739cce2abae5675c0c246a290

SHA1
9c4ea8208471f27b50a653addd06197f09f5ecc7

SHA256
12dd097d50206df4122e6444aef57143266fdfbeb0970a2d1770dfd24f0c7589

SHA512
cab8a3525b5e7b104cb9655e500a00e3a2b0346e528e77d1cc7137ae405fb42151e0c7341a7f5c96ddbb8e00e4c29c8aa8ccef247de2de0d18f8b4e589a7c582

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe

Filesize
468KB

MD5
8332b9ed68554862c18e46484dfd89d6

SHA1
f93d27366c2aed825a70a548536c541657f0979a

SHA256
fc6d9a9829b20219dfd12fb1f83ea296634ad6fb7e6f04e18f7a3863caea82bb

SHA512
b52a4d29ab152d25130be5a6d89964b7738b8639b41ac1c95cfa776d3b68e63d61849fee50453947c4454a00099f11a50ead80718c413903328586a9e91b3951

Download Submit