8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164ab

Analysis

max time kernel
116s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
Size

468KB
MD5

db679c8aabf08c5953829da78b64c060
SHA1

4601ee9672a86e426fba35be55097ea4e379f914
SHA256

8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164ab
SHA512

fe295b3fab894e93c921ac8cddf38d137c2e0bdd6d3d5515846f0ab3202e77d992eeaaa971e31c221a667082ae11ea1751ed9d3a05f64498385953ea022bed83
SSDEEP

3072:Mhomowrday8UWbYifz3s1f5ECHk+IDBxKHdjsPkTcs3B6pNGhlT:Mh9otLUWBfbs1fBOqfTciopNG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1636	Unicorn-43639.exe
1804	Unicorn-25248.exe
2408	Unicorn-40192.exe
384	Unicorn-1703.exe
3012	Unicorn-31038.exe
2760	Unicorn-44774.exe
2636	Unicorn-50904.exe
2980	Unicorn-3924.exe
2484	Unicorn-25667.exe
2936	Unicorn-29197.exe
1672	Unicorn-55739.exe
1716	Unicorn-57785.exe
2028	Unicorn-29005.exe
2240	Unicorn-28740.exe
1060	Unicorn-9139.exe
2704	Unicorn-10865.exe
2916	Unicorn-47622.exe
2780	Unicorn-43438.exe
2356	Unicorn-29702.exe
2464	Unicorn-49568.exe
400	Unicorn-6589.exe
1556	Unicorn-48753.exe
1900	Unicorn-29724.exe
1100	Unicorn-37627.exe
1040	Unicorn-37892.exe
1612	Unicorn-45960.exe
2188	Unicorn-54783.exe
1736	Unicorn-181.exe
2092	Unicorn-9111.exe
2192	Unicorn-9111.exe
2260	Unicorn-61026.exe
2116	Unicorn-13863.exe
2728	Unicorn-8296.exe
2176	Unicorn-9687.exe
3020	Unicorn-14439.exe
2836	Unicorn-20570.exe
2548	Unicorn-47212.exe
2964	Unicorn-47212.exe
2652	Unicorn-41544.exe
2556	Unicorn-61145.exe
2068	Unicorn-41544.exe
1916	Unicorn-38852.exe
2036	Unicorn-9002.exe
2284	Unicorn-49770.exe
1964	Unicorn-54119.exe
1940	Unicorn-34253.exe
1948	Unicorn-45136.exe
2796	Unicorn-65001.exe
1788	Unicorn-42535.exe
320	Unicorn-26107.exe
2804	Unicorn-26107.exe
1444	Unicorn-59956.exe
840	Unicorn-10954.exe
1068	Unicorn-19885.exe
2584	Unicorn-34829.exe
1628	Unicorn-54695.exe
3040	Unicorn-23969.exe
888	Unicorn-18301.exe
2124	Unicorn-32691.exe
2200	Unicorn-60725.exe
1260	Unicorn-25814.exe
2748	Unicorn-59163.exe
2688	Unicorn-10517.exe
2604	Unicorn-18131.exe

Loads dropped DLL 64 IoCs

pid	Process
2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
1636	Unicorn-43639.exe
2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
1636	Unicorn-43639.exe
2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
1804	Unicorn-25248.exe
1804	Unicorn-25248.exe
1636	Unicorn-43639.exe
1636	Unicorn-43639.exe
2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
2408	Unicorn-40192.exe
2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
2408	Unicorn-40192.exe
384	Unicorn-1703.exe
384	Unicorn-1703.exe
1804	Unicorn-25248.exe
1804	Unicorn-25248.exe
3012	Unicorn-31038.exe
3012	Unicorn-31038.exe
1636	Unicorn-43639.exe
1636	Unicorn-43639.exe
2760	Unicorn-44774.exe
2760	Unicorn-44774.exe
2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
2636	Unicorn-50904.exe
2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
2636	Unicorn-50904.exe
2408	Unicorn-40192.exe
2408	Unicorn-40192.exe
2980	Unicorn-3924.exe
2980	Unicorn-3924.exe
2484	Unicorn-25667.exe
2484	Unicorn-25667.exe
3012	Unicorn-31038.exe
1804	Unicorn-25248.exe
2936	Unicorn-29197.exe
1804	Unicorn-25248.exe
3012	Unicorn-31038.exe
2936	Unicorn-29197.exe
1716	Unicorn-57785.exe
1716	Unicorn-57785.exe
2760	Unicorn-44774.exe
2760	Unicorn-44774.exe
1672	Unicorn-55739.exe
1672	Unicorn-55739.exe
1636	Unicorn-43639.exe
1060	Unicorn-9139.exe
1636	Unicorn-43639.exe
1060	Unicorn-9139.exe
2408	Unicorn-40192.exe
2408	Unicorn-40192.exe
2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
2636	Unicorn-50904.exe
2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
2636	Unicorn-50904.exe
2028	Unicorn-29005.exe
2240	Unicorn-28740.exe
2028	Unicorn-29005.exe
2240	Unicorn-28740.exe
2704	Unicorn-10865.exe
2704	Unicorn-10865.exe
384	Unicorn-1703.exe
384	Unicorn-1703.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1224	1940	WerFault.exe	74
4108	2464	WerFault.exe	47
4196	1916	WerFault.exe	71

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45415.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
1636	Unicorn-43639.exe
1804	Unicorn-25248.exe
2408	Unicorn-40192.exe
384	Unicorn-1703.exe
3012	Unicorn-31038.exe
2760	Unicorn-44774.exe
2636	Unicorn-50904.exe
2484	Unicorn-25667.exe
2980	Unicorn-3924.exe
2936	Unicorn-29197.exe
1716	Unicorn-57785.exe
1672	Unicorn-55739.exe
2240	Unicorn-28740.exe
2028	Unicorn-29005.exe
1060	Unicorn-9139.exe
2704	Unicorn-10865.exe
2356	Unicorn-29702.exe
2916	Unicorn-47622.exe
2464	Unicorn-49568.exe
2780	Unicorn-43438.exe
400	Unicorn-6589.exe
1556	Unicorn-48753.exe
1100	Unicorn-37627.exe
2188	Unicorn-54783.exe
1612	Unicorn-45960.exe
2192	Unicorn-9111.exe
1900	Unicorn-29724.exe
1040	Unicorn-37892.exe
1736	Unicorn-181.exe
2092	Unicorn-9111.exe
2260	Unicorn-61026.exe
2116	Unicorn-13863.exe
2728	Unicorn-8296.exe
2176	Unicorn-9687.exe
3020	Unicorn-14439.exe
2836	Unicorn-20570.exe
2548	Unicorn-47212.exe
2964	Unicorn-47212.exe
2068	Unicorn-41544.exe
2556	Unicorn-61145.exe
2652	Unicorn-41544.exe
1916	Unicorn-38852.exe
1964	Unicorn-54119.exe
2796	Unicorn-65001.exe
1940	Unicorn-34253.exe
1948	Unicorn-45136.exe
2284	Unicorn-49770.exe
2036	Unicorn-9002.exe
2584	Unicorn-34829.exe
3040	Unicorn-23969.exe
1628	Unicorn-54695.exe
888	Unicorn-18301.exe
320	Unicorn-26107.exe
1788	Unicorn-42535.exe
2804	Unicorn-26107.exe
1068	Unicorn-19885.exe
840	Unicorn-10954.exe
2124	Unicorn-32691.exe
2200	Unicorn-60725.exe
1444	Unicorn-59956.exe
1260	Unicorn-25814.exe
2688	Unicorn-10517.exe
2748	Unicorn-59163.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1636	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	28
PID 2868 wrote to memory of 1636	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	28
PID 2868 wrote to memory of 1636	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	28
PID 2868 wrote to memory of 1636	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	28
PID 1636 wrote to memory of 1804	1636	Unicorn-43639.exe	29
PID 1636 wrote to memory of 1804	1636	Unicorn-43639.exe	29
PID 1636 wrote to memory of 1804	1636	Unicorn-43639.exe	29
PID 1636 wrote to memory of 1804	1636	Unicorn-43639.exe	29
PID 2868 wrote to memory of 2408	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	30
PID 2868 wrote to memory of 2408	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	30
PID 2868 wrote to memory of 2408	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	30
PID 2868 wrote to memory of 2408	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	30
PID 1804 wrote to memory of 384	1804	Unicorn-25248.exe	31
PID 1804 wrote to memory of 384	1804	Unicorn-25248.exe	31
PID 1804 wrote to memory of 384	1804	Unicorn-25248.exe	31
PID 1804 wrote to memory of 384	1804	Unicorn-25248.exe	31
PID 1636 wrote to memory of 3012	1636	Unicorn-43639.exe	32
PID 1636 wrote to memory of 3012	1636	Unicorn-43639.exe	32
PID 1636 wrote to memory of 3012	1636	Unicorn-43639.exe	32
PID 1636 wrote to memory of 3012	1636	Unicorn-43639.exe	32
PID 2868 wrote to memory of 2760	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	33
PID 2868 wrote to memory of 2760	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	33
PID 2868 wrote to memory of 2760	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	33
PID 2868 wrote to memory of 2760	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	33
PID 2408 wrote to memory of 2636	2408	Unicorn-40192.exe	34
PID 2408 wrote to memory of 2636	2408	Unicorn-40192.exe	34
PID 2408 wrote to memory of 2636	2408	Unicorn-40192.exe	34
PID 2408 wrote to memory of 2636	2408	Unicorn-40192.exe	34
PID 384 wrote to memory of 2980	384	Unicorn-1703.exe	35
PID 384 wrote to memory of 2980	384	Unicorn-1703.exe	35
PID 384 wrote to memory of 2980	384	Unicorn-1703.exe	35
PID 384 wrote to memory of 2980	384	Unicorn-1703.exe	35
PID 1804 wrote to memory of 2484	1804	Unicorn-25248.exe	36
PID 1804 wrote to memory of 2484	1804	Unicorn-25248.exe	36
PID 1804 wrote to memory of 2484	1804	Unicorn-25248.exe	36
PID 1804 wrote to memory of 2484	1804	Unicorn-25248.exe	36
PID 3012 wrote to memory of 2936	3012	Unicorn-31038.exe	37
PID 3012 wrote to memory of 2936	3012	Unicorn-31038.exe	37
PID 3012 wrote to memory of 2936	3012	Unicorn-31038.exe	37
PID 3012 wrote to memory of 2936	3012	Unicorn-31038.exe	37
PID 1636 wrote to memory of 1672	1636	Unicorn-43639.exe	38
PID 1636 wrote to memory of 1672	1636	Unicorn-43639.exe	38
PID 1636 wrote to memory of 1672	1636	Unicorn-43639.exe	38
PID 1636 wrote to memory of 1672	1636	Unicorn-43639.exe	38
PID 2760 wrote to memory of 1716	2760	Unicorn-44774.exe	39
PID 2760 wrote to memory of 1716	2760	Unicorn-44774.exe	39
PID 2760 wrote to memory of 1716	2760	Unicorn-44774.exe	39
PID 2760 wrote to memory of 1716	2760	Unicorn-44774.exe	39
PID 2868 wrote to memory of 2240	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	40
PID 2868 wrote to memory of 2240	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	40
PID 2868 wrote to memory of 2240	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	40
PID 2868 wrote to memory of 2240	2868	8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe	40
PID 2636 wrote to memory of 2028	2636	Unicorn-50904.exe	41
PID 2636 wrote to memory of 2028	2636	Unicorn-50904.exe	41
PID 2636 wrote to memory of 2028	2636	Unicorn-50904.exe	41
PID 2636 wrote to memory of 2028	2636	Unicorn-50904.exe	41
PID 2408 wrote to memory of 1060	2408	Unicorn-40192.exe	42
PID 2408 wrote to memory of 1060	2408	Unicorn-40192.exe	42
PID 2408 wrote to memory of 1060	2408	Unicorn-40192.exe	42
PID 2408 wrote to memory of 1060	2408	Unicorn-40192.exe	42
PID 2980 wrote to memory of 2704	2980	Unicorn-3924.exe	43
PID 2980 wrote to memory of 2704	2980	Unicorn-3924.exe	43
PID 2980 wrote to memory of 2704	2980	Unicorn-3924.exe	43
PID 2980 wrote to memory of 2704	2980	Unicorn-3924.exe	43

C:\Users\Admin\AppData\Local\Temp\8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe
"C:\Users\Admin\AppData\Local\Temp\8143890ea128eec856f47fd52889654a656d52049f81404a5a04f6be120164abN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1703.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3924.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        9⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
        9⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        9⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        9⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        8⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64426.exe
        9⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe
        8⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        8⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10517.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        8⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        8⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        8⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        7⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9941.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8781.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        7⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63055.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        8⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
        8⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
        8⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34606.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        7⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51895.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
        6⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51685.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        7⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        6⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        6⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41528.exe
        6⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        6⤵
        Executes dropped EXE
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        7⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        7⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        6⤵
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6214.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1830.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        6⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26299.exe
        5⤵
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52302.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
        8⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        8⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49367.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        7⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        7⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        7⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe
        6⤵
        
        PID:352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38687.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
        6⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        6⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12391.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        7⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        6⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37548.exe
        5⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        6⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38687.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        6⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        7⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        6⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        6⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
        5⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        6⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        6⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37351.exe
        5⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35838.exe
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        6⤵
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
        5⤵
        
        PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56138.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49772.exe
        5⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
        5⤵
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46917.exe
      4⤵
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        5⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
        5⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
        5⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5281.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58882.exe
      4⤵
      PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20083.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23436.exe
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
      4⤵
      PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21935.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16874.exe
        7⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 240
        7⤵
        Program crash
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        6⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        6⤵
        
        PID:3960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 216
        6⤵
        Program crash
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34253.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 244
        6⤵
        Program crash
        
        PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
        5⤵
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        5⤵
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9687.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
        6⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        7⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-736.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        8⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        7⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        6⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        7⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        6⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        5⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        6⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15093.exe
        5⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14439.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40881.exe
        5⤵
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
        6⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25768.exe
        6⤵
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        6⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe
        5⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        5⤵
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
      4⤵
      PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
      4⤵
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31542.exe
      4⤵
      PID:6392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29724.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27259.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        7⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        7⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
        6⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38978.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        5⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        6⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
        5⤵
        
        PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
        5⤵
        
        PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45136.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57902.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
      4⤵
      PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37627.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26107.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
        5⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30518.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21674.exe
      4⤵
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38027.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24722.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58155.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
      4⤵
      PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
      4⤵
      PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
    3⤵
    PID:324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
    3⤵
    PID:3884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13002.exe
    3⤵
    PID:5536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23969.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45349.exe
        7⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17420.exe
        8⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        9⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        9⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        9⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25945.exe
        8⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8251.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        7⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        7⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        6⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        7⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43428.exe
        7⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50273.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
        7⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        6⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21582.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
        6⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32691.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
        6⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40206.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56267.exe
        7⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        6⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12851.exe
        5⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35167.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39508.exe
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
        5⤵
        
        PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54783.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        6⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        6⤵
        
        PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        5⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        6⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        6⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
        5⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43503.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        5⤵
        
        PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50273.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56181.exe
        5⤵
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
      4⤵
      PID:608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
      4⤵
      PID:6404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        6⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15738.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24722.exe
        7⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        6⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27320.exe
        5⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47010.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        6⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
        6⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18602.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2069.exe
        5⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31626.exe
      4⤵
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
        5⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        5⤵
        
        PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
      4⤵
      PID:496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5047.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
      4⤵
      PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14137.exe
      4⤵
      PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14404.exe
      4⤵
      PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14961.exe
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39645.exe
      4⤵
      PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
      4⤵
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        5⤵
        
        PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        5⤵
        
        PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
      4⤵
      PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6100.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
      4⤵
      PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31841.exe
    3⤵
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37694.exe
      4⤵
      PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
      4⤵
      PID:6228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
    3⤵
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39217.exe
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
    3⤵
    PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44774.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44774.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        6⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23881.exe
        7⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        7⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37455.exe
        6⤵
        
        PID:268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        6⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        6⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
        5⤵
        
        PID:388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47473.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33236.exe
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe
        5⤵
        
        PID:6424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
        5⤵
        
        PID:704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
      4⤵
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        5⤵
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46039.exe
      4⤵
      PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38687.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
      4⤵
      PID:5828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60725.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47186.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52572.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62708.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14195.exe
      4⤵
      PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5281.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
      4⤵
      PID:6800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41971.exe
      4⤵
      PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18436.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26817.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17777.exe
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55822.exe
    3⤵
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
    3⤵
    PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
    3⤵
    PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
    3⤵
    PID:6848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28740.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28740.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19885.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17732.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
      4⤵
      PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30225.exe
      4⤵
      PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
      4⤵
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
      4⤵
      PID:6932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34829.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49708.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1841.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24616.exe
        5⤵
        
        PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38389.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
    3⤵
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
      4⤵
      PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
      4⤵
      PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64020.exe
    3⤵
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38687.exe
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
    3⤵
    PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
    3⤵
    PID:5896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26107.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47570.exe
      4⤵
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8251.exe
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
    3⤵
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
    3⤵
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
    3⤵
    PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
    3⤵
    PID:6340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50886.exe
    3⤵
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30071.exe
      4⤵
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54165.exe
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
    3⤵
    PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
    3⤵
    PID:932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38786.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38786.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
    3⤵
    PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55089.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
  2⤵
  PID:3184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12351.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12351.exe
  2⤵
  PID:4172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23967.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23967.exe
  2⤵
  PID:5148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37482.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37482.exe
  2⤵
  PID:6064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe

Filesize
468KB

MD5
dfa20c0d253baaa174dbfde65fcc299e

SHA1
e6563b9d086235657442286c9b72735d747301c5

SHA256
99fb863290f108ab7e2baa308d9fd0d7e5eebc1b2767386bdf90c062aad31c37

SHA512
985c5f0627542df9291aa5352fda0cb2b2377a58138f3733c988362c54a001524f2d5376691ac17651ed4ced30fb50dcf573475391fda691830a9a3f0036b59e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1703.exe

Filesize
468KB

MD5
05a6cc59de92afacb0052e537b92faf2

SHA1
91c0ae8f58bbef336aa7ff4e1b7490d83f674490

SHA256
f7f102d9ff5fc5a01ea534c15f7d251a577450569ba2c4f8055da45c1040ff5e

SHA512
655ef63d6eff33d35744edbffb4f19801d1903cad9954a733e853f8d13aa9e4ff0adf903c2568632fb60d1c6f2150191159f16b21976d987fefd9f0b5a22dd76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe

Filesize
468KB

MD5
db241c04c3a9075c866755e2fdd0a004

SHA1
1ec715f9baf381a35745df5aee528480fb758f8e

SHA256
6d2087dc1402b1215ca63b86f9ec5fa25f2eb703c5e22b2ad8e9a1c50085099d

SHA512
7be3464076540044b6477c4ee61dd8034f073aa6fa7c84c9e9ac407db164e5974456cb395c3149a0b635c05e60d5e0ca72e2dd280780223caf42c79d121aafa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28740.exe

Filesize
468KB

MD5
50da5490c39407d6b390320ca9cf693b

SHA1
35a8d95741dc2735dc78e8b55a038d73c0c1f573

SHA256
bb2e6c69d1ce9c96ffc35394e34528a6571c738487012ec0c179faebeb10daca

SHA512
c6212e6932284d5ca0514f4eb264b44c7596c7a67ed74241bb9396af354b51fd6ec60c311562ef593b6b507553b4c376167ecb245264ce12676d67874174a74f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44774.exe

Filesize
468KB

MD5
342762f54e1485efee6f0f098dcbbf35

SHA1
bff805b1fa4499931d6fb674fca5ea6b6dd4a55f

SHA256
d7b2886a1123eee2dbe899f683b0f0d76374007423549b8ea78acc6c1241bbdd

SHA512
bf576eb9a0310e013fe42a689bcb5e7cc40742c958e902240fd50b028f20ac269f82a717180128de10032ccf00df5260bd6725071dd7cb24343aa3533d5f016a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe

Filesize
468KB

MD5
c759612d968988634f8cca4523b1b3d7

SHA1
8bdc1dc129745d772c1f468d24e5b2f3b3eda2ed

SHA256
63c52bd010ef85e6eab0e2957c8473ce43c6bb796b516a42fcdb46913c402e22

SHA512
9210b7afc2b8a2fb1e5bf0eb2e0ba0c75718523f161833ccaf9e49c973ef282ca32ac5b7fd18af9396b5b5e524f92e1835b5955f80809589aa2809a7af207c42

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe

Filesize
468KB

MD5
2b07e1d1003e4e4978636a3d5f313894

SHA1
e7f35bc02b138d6f5fd4b925d5a8f5fcbad9fc8a

SHA256
e9ad9bd2a43159428709f10bfd5bcb56dfdbbb2f078f3b26a34901b8c996df57

SHA512
e4030b3d7d6e53c52ca7687c516d17b1d171b9dbdc56687f018bd7302aa13fd1569404f09640def45375a791189a3744a2a5dec1b4b64de3eaadf25fee763b59

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe

Filesize
468KB

MD5
c0b181edaa035b46498779b8e203fe99

SHA1
dc72a63f366cd9e07b7d057794c3f9bba4215370

SHA256
000fb6fc856f80c604ba3aeff15c6476265652dfcba945716428d4ee7c2bf93a

SHA512
e92609f7a37c39f10aee01e33468c23cc43d9b60be3f4f8d6039bd2e4660359cdf3a16810b48d23640d83c46b39284a952db3990ec94ca94ecd5e0d60f1deca6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe

Filesize
468KB

MD5
9090f7ef73ce63cdcb8eacc28a4c15fc

SHA1
d687a4914f5124ca0464d8bd816005f484397c5b

SHA256
fc815e8128dc443dad77752741c2d8a1e9b443fc023818696f210f84adc74a39

SHA512
f34650341d7b3e19ca5a1db6942ecbac5db8833b4abbdc5764b414976cd59f42b8ab49d4e3fd2b5f68e324841fb8321e03455b04e2aa0efef48588de5626ba6e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe

Filesize
468KB

MD5
b00e82c34dccad3b5e8102f4b434ec8a

SHA1
92861638d510427c9fc93d624fdcc1e192ef2b48

SHA256
8a591ad1d74fa3b0c02187ba483735441d85999ab3226a6296b84014cff204b3

SHA512
e00f68e63728d34cffa5628698a5a38df9000351e9850e7c5804afa3c8fe093c8c053f90050e6273eb0a3caeba2fde3a4296ad1a73fdce67507888569433810a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe

Filesize
468KB

MD5
4695dcda55102db9812a31b620e4ab74

SHA1
10ea57fd5b66b51f48ba03cba5384b2966c0c1f1

SHA256
a40c6ec975d765bb9a31e8643ebe9dfa393ec3e9824ed20ad4fd9df449cf42de

SHA512
571803613528735dc6598cbc99e3e1d037b551a1412f9726a3d0c9adbced236dd86d989c011d7e92b4972c4342f7c6e0c795bbf8acef89ce42ba2f3bbfba0c3c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3924.exe

Filesize
468KB

MD5
2ad3a177b4c46ff73283970d81bb51ce

SHA1
39675de56f54aad7ab01f9e913b763569e13d29f

SHA256
0a7c8e3fc41ab81370068a91844aa8190a88a111dec9574044ef4cf192bcda4a

SHA512
e44c403d48836cddc2921f09d50a49b18842c70003df0494241aa2cc8760b074e6640c25496be134bae57db5796ca61dd968cf6ae3dc7669e64c807a94a65f21

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe

Filesize
468KB

MD5
2d6779e752c0bb6e10910b5c243c14e7

SHA1
7debc70444ff52b90546ee10511d78ad0f8e0a41

SHA256
31d1404d80ee724d0db9523141cc6ac2aaa39ba440e98b9bcab52dfb43530220

SHA512
7d039fc7df7bf4e40bd138c18bd38fc19da4f27e301a181cb67bdb3e0d8f6d9320d1fb394d3553376818517f4c0c025b4ca1011dbefe2c2a9744b7a7276b2ad2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe

Filesize
468KB

MD5
4f3de931026aa7378aa091d125dab3ff

SHA1
fe8342256bfddb8b36bbc33f08c79f5e474510d4

SHA256
9d4c4a4711927959cae8f589fd7b640e22eb2cfc8eaf1c96d1c6e0f81f07d108

SHA512
6a5e20d287f2b50e59885e052c66298de5d54798c8c5e1d350fac72e6a82ea4194982682aebc9ff629e5daac7dbb74acf6ff51cd0b927b9b22701784e494e44a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe

Filesize
468KB

MD5
09834b579daf53a6efb73d0723884904

SHA1
d9e15fcba5b4feb9bbd7ed19781d9a4b343b9537

SHA256
e7f3cf07135a6da9e675fcc4dd6a6bdc7dfe3f97e81bf92c07943b60fdae4234

SHA512
6628ccc90766a8a0289ce27cdd1ef7259439885fb12b5bca2bab769ce4c5a193e02d23c2e6813e3eb57302a54ef2e1bcf52040d1e1b74334a74d7a9d9519a95e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe

Filesize
468KB

MD5
2f17dd1c59957399b087bc2cb700d7e6

SHA1
f41c8b2e2fbade8a9663606ab3128737e006ccbc

SHA256
de087c2bbf1e619513684b3913b2046c45ba6ff3e252e0b399cbae3cddfe1e93

SHA512
8e0d7a98c42f809a616134379079edad92f670a926cbfb943b032b1b972b3010d26a8db77dcea94589a81ad806ec4bb828f2d7e6efc8b6f868c2ce61e3bb1cf4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe

Filesize
468KB

MD5
2dcd54b00f146abf216949d109343225

SHA1
101b5cca1d3a672f501f075e99ad47b32fd94e5d

SHA256
ad0f05af3a0943f1fb31071f910f3c8d72c2dea71525fb63baa6b5674e6447fc

SHA512
e202bfab5ca196f1801d95e8ff168222cf9aebe499c9e937b07be6957289340bc4103d61c4bcdd8ecd3e7d5172304edd4baef9eedc0865f5d97ebacb9f72f31a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe

Filesize
468KB

MD5
7b6aed522ae2b1bb758fd2c0b61a44b7

SHA1
b7d3f4c085034516eb25666c81f391f594380139

SHA256
6c4fe6177192f7dc52392152cb29d72dba2ef71508ece96596968593094835c1

SHA512
042d2bac92b7dfcdb7800399e6282546b0cab5361ddd641028c1993d1ec45788996c3881be6a096a0ada261507f6d3724fc47e79f85c5c51b2cc35bbd6d149f2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe

Filesize
468KB

MD5
a9993f8360ea0d4a401eea1eea3aaf33

SHA1
16f02ade98352e85bb7360eefbc3ec55d86e67bd

SHA256
bc377f1b71f8207c518063597fb073a0301001e6a419413316835aa599ba4f1f

SHA512
73a6a823e23642ce6c099a8b9c4070cd89f7d9c1672fa8c15ac846642bc310aab3b76ec321d85641dfb11c1e0076576fa0909a278fb5069f0212001f7f84a8c0

Download Submit
memory/384-100-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/384-358-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/384-99-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/384-360-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/384-52-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/400-403-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/400-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/400-404-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/1040-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-285-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/1060-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-295-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/1100-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1612-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-293-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1636-145-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1636-66-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1636-143-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1636-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-65-0x0000000001CB0000-0x0000000001D25000-memory.dmp

Filesize
468KB

Download
memory/1636-284-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/1636-32-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/1672-280-0x0000000002900000-0x0000000002975000-memory.dmp

Filesize
468KB

Download
memory/1672-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-256-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1716-257-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1716-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-241-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1804-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-240-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1804-50-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1804-51-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/1900-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-322-0x0000000001C50000-0x0000000001CC5000-memory.dmp

Filesize
468KB

Download
memory/2028-321-0x0000000001C50000-0x0000000001CC5000-memory.dmp

Filesize
468KB

Download
memory/2092-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-325-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2240-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-320-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2260-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-380-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2356-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-303-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2408-180-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2408-302-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2408-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-179-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2464-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-216-0x00000000030F0000-0x0000000003165000-memory.dmp

Filesize
468KB

Download
memory/2484-217-0x00000000030F0000-0x0000000003165000-memory.dmp

Filesize
468KB

Download
memory/2484-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-318-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/2636-169-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/2636-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-316-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/2636-178-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/2704-349-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2704-348-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2704-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-270-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2760-150-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2760-147-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2760-271-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2760-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-401-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2780-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-172-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2868-319-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2868-11-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2868-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-10-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2868-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-33-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2916-405-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2916-400-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2916-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-242-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2980-202-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2980-368-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2980-203-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/3012-389-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/3012-391-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/3012-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-239-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/3012-243-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/3020-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download