d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609d

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
Size

468KB
MD5

bb715f1be6c994ce32630b8eeb9ebfa0
SHA1

b45231700f99dda04f8e90d98f5d7b0e28b2fe5b
SHA256

d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609d
SHA512

4429f9db0911d68bdf508f1223b5dca1345995ab0729cdafbb38327c86d31691d0bcd53e9a6ae0346f602f88ed59a4cbba0d5319d1720f35eb876afc5365b01d
SSDEEP

3072:pqxRog8djY8U2bxAPz5Wff5PChjWL+PkmHevVFfn58WQ3Yha4DVl0:pqDoD1U2OP1WffRKmj58WuAa4D

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1212	Unicorn-61297.exe
2156	Unicorn-4258.exe
2324	Unicorn-38118.exe
2848	Unicorn-33714.exe
2892	Unicorn-62556.exe
2752	Unicorn-16693.exe
2792	Unicorn-61216.exe
1600	Unicorn-26260.exe
1768	Unicorn-4282.exe
544	Unicorn-48756.exe
1932	Unicorn-46680.exe
1444	Unicorn-1008.exe
1628	Unicorn-60415.exe
1936	Unicorn-551.exe
2480	Unicorn-49571.exe
2336	Unicorn-30473.exe
1080	Unicorn-35569.exe
764	Unicorn-50339.exe
688	Unicorn-37868.exe
288	Unicorn-57734.exe
1060	Unicorn-57770.exe
1532	Unicorn-63328.exe
1724	Unicorn-29722.exe
2568	Unicorn-29457.exe
2012	Unicorn-45565.exe
2056	Unicorn-54906.exe
2984	Unicorn-45976.exe
2444	Unicorn-48776.exe
2244	Unicorn-35040.exe
2112	Unicorn-47771.exe
2772	Unicorn-29083.exe
2672	Unicorn-5233.exe
2856	Unicorn-65408.exe
2108	Unicorn-39551.exe
460	Unicorn-54477.exe
1484	Unicorn-45724.exe
1308	Unicorn-59299.exe
1616	Unicorn-1816.exe
296	Unicorn-1816.exe
2516	Unicorn-47488.exe
2016	Unicorn-14815.exe
1064	Unicorn-32796.exe
2676	Unicorn-20182.exe
2308	Unicorn-35184.exe
2464	Unicorn-35449.exe
3004	Unicorn-18070.exe
672	Unicorn-62017.exe
2576	Unicorn-35667.exe
1748	Unicorn-25468.exe
916	Unicorn-7545.exe
1516	Unicorn-27411.exe
1380	Unicorn-27411.exe
2352	Unicorn-27722.exe
2552	Unicorn-27987.exe
1576	Unicorn-6009.exe
1584	Unicorn-25875.exe
2760	Unicorn-35501.exe
1244	Unicorn-38302.exe
2948	Unicorn-42455.exe
2736	Unicorn-20285.exe
2412	Unicorn-44759.exe
848	Unicorn-23745.exe
1672	Unicorn-45335.exe
1356	Unicorn-43258.exe

Loads dropped DLL 64 IoCs

pid	Process
2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
1212	Unicorn-61297.exe
1212	Unicorn-61297.exe
2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
2156	Unicorn-4258.exe
2156	Unicorn-4258.exe
1212	Unicorn-61297.exe
1212	Unicorn-61297.exe
2324	Unicorn-38118.exe
2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
2324	Unicorn-38118.exe
2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
2848	Unicorn-33714.exe
2848	Unicorn-33714.exe
2156	Unicorn-4258.exe
2156	Unicorn-4258.exe
2752	Unicorn-16693.exe
2752	Unicorn-16693.exe
2324	Unicorn-38118.exe
2892	Unicorn-62556.exe
2324	Unicorn-38118.exe
2892	Unicorn-62556.exe
1212	Unicorn-61297.exe
1212	Unicorn-61297.exe
2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
1600	Unicorn-26260.exe
1600	Unicorn-26260.exe
1768	Unicorn-4282.exe
2848	Unicorn-33714.exe
2156	Unicorn-4258.exe
2848	Unicorn-33714.exe
1768	Unicorn-4282.exe
2156	Unicorn-4258.exe
2792	Unicorn-61216.exe
544	Unicorn-48756.exe
544	Unicorn-48756.exe
2792	Unicorn-61216.exe
2752	Unicorn-16693.exe
2752	Unicorn-16693.exe
1628	Unicorn-60415.exe
1628	Unicorn-60415.exe
1936	Unicorn-551.exe
1212	Unicorn-61297.exe
1936	Unicorn-551.exe
1212	Unicorn-61297.exe
1932	Unicorn-46680.exe
1932	Unicorn-46680.exe
2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
1444	Unicorn-1008.exe
2324	Unicorn-38118.exe
1444	Unicorn-1008.exe
2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
2324	Unicorn-38118.exe
2892	Unicorn-62556.exe
2892	Unicorn-62556.exe
2480	Unicorn-49571.exe
2480	Unicorn-49571.exe
1600	Unicorn-26260.exe
1600	Unicorn-26260.exe
2336	Unicorn-30473.exe
2336	Unicorn-30473.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2896	1080	WerFault.exe	48
1548	2464	WerFault.exe	75

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61285.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
1212	Unicorn-61297.exe
2156	Unicorn-4258.exe
2324	Unicorn-38118.exe
2848	Unicorn-33714.exe
2752	Unicorn-16693.exe
2792	Unicorn-61216.exe
2892	Unicorn-62556.exe
1600	Unicorn-26260.exe
1768	Unicorn-4282.exe
544	Unicorn-48756.exe
1628	Unicorn-60415.exe
1936	Unicorn-551.exe
1444	Unicorn-1008.exe
1932	Unicorn-46680.exe
2480	Unicorn-49571.exe
288	Unicorn-57734.exe
2336	Unicorn-30473.exe
764	Unicorn-50339.exe
1080	Unicorn-35569.exe
688	Unicorn-37868.exe
1532	Unicorn-63328.exe
1060	Unicorn-57770.exe
2056	Unicorn-54906.exe
2244	Unicorn-35040.exe
2444	Unicorn-48776.exe
2568	Unicorn-29457.exe
2984	Unicorn-45976.exe
1724	Unicorn-29722.exe
2012	Unicorn-45565.exe
2112	Unicorn-47771.exe
2772	Unicorn-29083.exe
2672	Unicorn-5233.exe
2856	Unicorn-65408.exe
2108	Unicorn-39551.exe
460	Unicorn-54477.exe
1484	Unicorn-45724.exe
1308	Unicorn-59299.exe
1616	Unicorn-1816.exe
296	Unicorn-1816.exe
2516	Unicorn-47488.exe
2676	Unicorn-20182.exe
1064	Unicorn-32796.exe
2464	Unicorn-35449.exe
2308	Unicorn-35184.exe
3004	Unicorn-18070.exe
672	Unicorn-62017.exe
2016	Unicorn-14815.exe
1380	Unicorn-27411.exe
2552	Unicorn-27987.exe
1516	Unicorn-27411.exe
916	Unicorn-7545.exe
1584	Unicorn-25875.exe
1576	Unicorn-6009.exe
1748	Unicorn-25468.exe
2576	Unicorn-35667.exe
2352	Unicorn-27722.exe
1244	Unicorn-38302.exe
2760	Unicorn-35501.exe
2948	Unicorn-42455.exe
2736	Unicorn-20285.exe
2412	Unicorn-44759.exe
848	Unicorn-23745.exe
1672	Unicorn-45335.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1212	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	31
PID 2380 wrote to memory of 1212	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	31
PID 2380 wrote to memory of 1212	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	31
PID 2380 wrote to memory of 1212	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	31
PID 1212 wrote to memory of 2156	1212	Unicorn-61297.exe	32
PID 1212 wrote to memory of 2156	1212	Unicorn-61297.exe	32
PID 1212 wrote to memory of 2156	1212	Unicorn-61297.exe	32
PID 1212 wrote to memory of 2156	1212	Unicorn-61297.exe	32
PID 2380 wrote to memory of 2324	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	33
PID 2380 wrote to memory of 2324	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	33
PID 2380 wrote to memory of 2324	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	33
PID 2380 wrote to memory of 2324	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	33
PID 2156 wrote to memory of 2848	2156	Unicorn-4258.exe	34
PID 2156 wrote to memory of 2848	2156	Unicorn-4258.exe	34
PID 2156 wrote to memory of 2848	2156	Unicorn-4258.exe	34
PID 2156 wrote to memory of 2848	2156	Unicorn-4258.exe	34
PID 1212 wrote to memory of 2892	1212	Unicorn-61297.exe	35
PID 1212 wrote to memory of 2892	1212	Unicorn-61297.exe	35
PID 1212 wrote to memory of 2892	1212	Unicorn-61297.exe	35
PID 1212 wrote to memory of 2892	1212	Unicorn-61297.exe	35
PID 2324 wrote to memory of 2752	2324	Unicorn-38118.exe	36
PID 2324 wrote to memory of 2752	2324	Unicorn-38118.exe	36
PID 2324 wrote to memory of 2752	2324	Unicorn-38118.exe	36
PID 2324 wrote to memory of 2752	2324	Unicorn-38118.exe	36
PID 2380 wrote to memory of 2792	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	37
PID 2380 wrote to memory of 2792	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	37
PID 2380 wrote to memory of 2792	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	37
PID 2380 wrote to memory of 2792	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	37
PID 2848 wrote to memory of 1600	2848	Unicorn-33714.exe	38
PID 2848 wrote to memory of 1600	2848	Unicorn-33714.exe	38
PID 2848 wrote to memory of 1600	2848	Unicorn-33714.exe	38
PID 2848 wrote to memory of 1600	2848	Unicorn-33714.exe	38
PID 2156 wrote to memory of 1768	2156	Unicorn-4258.exe	39
PID 2156 wrote to memory of 1768	2156	Unicorn-4258.exe	39
PID 2156 wrote to memory of 1768	2156	Unicorn-4258.exe	39
PID 2156 wrote to memory of 1768	2156	Unicorn-4258.exe	39
PID 2752 wrote to memory of 544	2752	Unicorn-16693.exe	40
PID 2752 wrote to memory of 544	2752	Unicorn-16693.exe	40
PID 2752 wrote to memory of 544	2752	Unicorn-16693.exe	40
PID 2752 wrote to memory of 544	2752	Unicorn-16693.exe	40
PID 2324 wrote to memory of 1932	2324	Unicorn-38118.exe	41
PID 2324 wrote to memory of 1932	2324	Unicorn-38118.exe	41
PID 2324 wrote to memory of 1932	2324	Unicorn-38118.exe	41
PID 2324 wrote to memory of 1932	2324	Unicorn-38118.exe	41
PID 2892 wrote to memory of 1444	2892	Unicorn-62556.exe	42
PID 2892 wrote to memory of 1444	2892	Unicorn-62556.exe	42
PID 2892 wrote to memory of 1444	2892	Unicorn-62556.exe	42
PID 2892 wrote to memory of 1444	2892	Unicorn-62556.exe	42
PID 1212 wrote to memory of 1628	1212	Unicorn-61297.exe	43
PID 1212 wrote to memory of 1628	1212	Unicorn-61297.exe	43
PID 1212 wrote to memory of 1628	1212	Unicorn-61297.exe	43
PID 1212 wrote to memory of 1628	1212	Unicorn-61297.exe	43
PID 2380 wrote to memory of 1936	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	44
PID 2380 wrote to memory of 1936	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	44
PID 2380 wrote to memory of 1936	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	44
PID 2380 wrote to memory of 1936	2380	d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe	44
PID 1600 wrote to memory of 2480	1600	Unicorn-26260.exe	45
PID 1600 wrote to memory of 2480	1600	Unicorn-26260.exe	45
PID 1600 wrote to memory of 2480	1600	Unicorn-26260.exe	45
PID 1600 wrote to memory of 2480	1600	Unicorn-26260.exe	45
PID 2848 wrote to memory of 2336	2848	Unicorn-33714.exe	47
PID 2848 wrote to memory of 2336	2848	Unicorn-33714.exe	47
PID 2848 wrote to memory of 2336	2848	Unicorn-33714.exe	47
PID 2848 wrote to memory of 2336	2848	Unicorn-33714.exe	47

C:\Users\Admin\AppData\Local\Temp\d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe
"C:\Users\Admin\AppData\Local\Temp\d75f1d4af2e94ad0cd17ab0ca7cfac85b01647b8774fe9a958ed312f7d5e609dN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33714.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47771.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        9⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53851.exe
        10⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
        10⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        9⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        9⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        9⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22988.exe
        8⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        9⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        9⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61095.exe
        8⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        8⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20285.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61885.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        8⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        8⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        8⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30449.exe
        8⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        7⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29083.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        8⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        8⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17899.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        8⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exe
        7⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48980.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        7⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
        7⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13776.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5248.exe
        7⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36803.exe
        6⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9872.exe
        6⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45335.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6994.exe
        8⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2928.exe
        9⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        9⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        9⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        9⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        8⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        8⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        7⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38438.exe
        8⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9234.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        7⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
        6⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        7⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
        6⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        6⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
        6⤵
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65408.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31054.exe
        6⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        8⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        8⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46890.exe
        8⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2568.exe
        7⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        8⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        8⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2887.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        7⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        6⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        8⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        8⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        8⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55555.exe
        8⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13395.exe
        7⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        7⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2887.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        5⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3948.exe
        6⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14740.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63951.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49615.exe
        7⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49010.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3802.exe
        6⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21873.exe
        5⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12382.exe
        6⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        6⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        5⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
        5⤵
        
        PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50339.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
        7⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27402.exe
        8⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        7⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
        6⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        7⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        6⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
        6⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32796.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        6⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8822.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19107.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        7⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        6⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23014.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        7⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        7⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
        6⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exe
        6⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57799.exe
        6⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26367.exe
        5⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3518.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59650.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35449.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 240
        6⤵
        Program crash
        
        PID:1548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 236
        5⤵
        Program crash
        
        PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35184.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        5⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
        6⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        7⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47217.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        6⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
        5⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
        5⤵
        
        PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
      4⤵
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        5⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        5⤵
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62556.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1008.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        7⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28616.exe
        8⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        8⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
        7⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
        6⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50903.exe
        7⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52228.exe
        6⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        6⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31301.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        6⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        6⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        5⤵
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exe
        5⤵
        
        PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35040.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        6⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        7⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        6⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        5⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24208.exe
        6⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
        8⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        8⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
        8⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        7⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        6⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        5⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62737.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43376.exe
        6⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30449.exe
        7⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        6⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9751.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        6⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        5⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        5⤵
        
        PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
      4⤵
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        5⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6570.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38044.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50228.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38010.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe
      4⤵
      PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53578.exe
      4⤵
      PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
      4⤵
      PID:7212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60415.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        7⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        8⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        8⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        8⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
        6⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        5⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        6⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34605.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
        7⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16307.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        5⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52165.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36237.exe
        5⤵
        
        PID:904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
        5⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-808.exe
        6⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17899.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47009.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      4⤵
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        5⤵
        
        PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14778.exe
      4⤵
      PID:7700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31821.exe
        5⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41494.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52548.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38897.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
      4⤵
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13622.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        5⤵
        
        PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
      4⤵
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19171.exe
      4⤵
      PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35501.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
      4⤵
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        5⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        5⤵
        
        PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
      4⤵
      PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
      4⤵
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56772.exe
    3⤵
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
      4⤵
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5248.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2886.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
      4⤵
      PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe
      4⤵
      PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27248.exe
      4⤵
      PID:7316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38534.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
    3⤵
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
    3⤵
    PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45705.exe
    3⤵
    PID:6568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exe
        7⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        9⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        9⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        8⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        8⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47861.exe
        7⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        8⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24829.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38479.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-441.exe
        8⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18557.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19171.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
        6⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
        7⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37246.exe
        6⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        6⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        6⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59299.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        6⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        7⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17899.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31166.exe
        7⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
        6⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53740.exe
        5⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9764.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
        5⤵
        
        PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57770.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27987.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1068.exe
        6⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        7⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        6⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        5⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        6⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30162.exe
        5⤵
        
        PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38302.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        5⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe
        6⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55420.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        6⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57313.exe
        6⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2887.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        6⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        6⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe
        5⤵
        
        PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
      4⤵
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        5⤵
        
        PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31913.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
      4⤵
      PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        6⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13628.exe
        7⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38781.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
        6⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64664.exe
        5⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50213.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
        5⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55459.exe
        5⤵
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe
        5⤵
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
      4⤵
      PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
      4⤵
      PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
      4⤵
      PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
      4⤵
      PID:7324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        5⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
        6⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        5⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
      4⤵
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51749.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
      4⤵
      PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37068.exe
      4⤵
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32476.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
      4⤵
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36282.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
      4⤵
      PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
      4⤵
      PID:7800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9926.exe
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
    3⤵
    PID:5828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
    3⤵
    PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
    3⤵
    PID:7960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61216.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61216.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37868.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43258.exe
      4⤵
      Executes dropped EXE
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        5⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3226.exe
        5⤵
        
        PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
      4⤵
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        5⤵
        
        PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
      4⤵
      PID:6464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
      4⤵
      PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        5⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30198.exe
        6⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        6⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3226.exe
        5⤵
        
        PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
      4⤵
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61375.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13504.exe
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exe
    3⤵
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60072.exe
      4⤵
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46698.exe
      4⤵
      PID:6624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22885.exe
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
    3⤵
    PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
    3⤵
    PID:6076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3704.exe
    3⤵
    PID:6536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-551.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6042.exe
        6⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5248.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19757.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
      4⤵
      PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47958.exe
      4⤵
      PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
      4⤵
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        5⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14739.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        5⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        5⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42768.exe
        5⤵
        
        PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54886.exe
      4⤵
      PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
      4⤵
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
      4⤵
      PID:6200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exe
    3⤵
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14384.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        5⤵
        
        PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38013.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
      4⤵
      PID:6744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17959.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51792.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
      4⤵
      PID:6412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49717.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
    3⤵
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59650.exe
    3⤵
    PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48338.exe
    3⤵
    PID:6648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
      4⤵
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        5⤵
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29295.exe
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        5⤵
        
        PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
      4⤵
      PID:352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65523.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5248.exe
      4⤵
      PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
    3⤵
    PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
      4⤵
      PID:7248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
    3⤵
    PID:3680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
    3⤵
    PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe
    3⤵
    PID:7980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
    3⤵
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
      4⤵
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15490.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        5⤵
        
        PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42585.exe
      4⤵
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
      4⤵
      PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
      4⤵
      PID:7740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2568.exe
    3⤵
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
    3⤵
    PID:4788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
    3⤵
    PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
  2⤵
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
    3⤵
    PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
    3⤵
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
    3⤵
    PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
    3⤵
    PID:7728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
  2⤵
  PID:3176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58958.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58958.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
  2⤵
  PID:5240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
  2⤵
  PID:6784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1008.exe

Filesize
468KB

MD5
df98dacfc1a03a378ded72cac15d02db

SHA1
d4dc3d2d727f431d5b91f4883d9f72132d17c366

SHA256
9ed916da0228c54e14f521b7e8b931c9a25dcd2b66264e6953de02c3ccb13029

SHA512
e6a24e8b208c51214c8ad7db1085105ed4fb5aee4ccbcc3e23083a76b3a9e736b49bbfb788d9179e55e6869714e693d4f61489f77bf15e36179a9774fb8d7f5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe

Filesize
468KB

MD5
1b49fa38f5c1c3e190b6749a43242e37

SHA1
92b74db2a8429a532850598d66a8da74a6a2f87f

SHA256
54ed825924004813aee0f2299546637432e121b93b23c54e306836ed26015b1d

SHA512
9842bf596b8c1e395c1c88cf4de4dd6f77bd43f5cfc73cc2900b181a0d451f7114923481bc2f1ece9fb9abad6c5875d6112c48d6a389a208ef9708f98369ea20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe

Filesize
468KB

MD5
4aea90724b29e0715c58aa905766273c

SHA1
c662cb1a1fc521ac7b8325c86bd02b38a4812009

SHA256
de1bd92bcc4c614ab2644b75cdf7538534058bb80b7cff0ec74efd441c89a966

SHA512
3b4ebd4b9c89d65ff632999432665170c41195713d1cba69c862beda0e50b6710729a34805c86cf7cc43052064ded86efd7c960f1bd3e8750afb7e65f205577f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe

Filesize
468KB

MD5
0c211bb9e855f7046513a467edfb3f30

SHA1
8d61bc8dcd260302bc08f019f7ec046c8551a3c6

SHA256
80f8c952fb20b31219921a7272956719467c1001d168af2fcdf0203c2ac6565f

SHA512
3193a3d0692f295dba50c44b72c55b8f32365689311e2b21c986346e03facaaa1b72eca7424826857e54866aaec36cdac904a7cdcbb3122be1f9fe9a5299f32b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe

Filesize
468KB

MD5
2a72b5f6fd4fa31a82299d09670efa7b

SHA1
d0d401aa57c5fdeab486dddea6fd21fee2335111

SHA256
7b293bbda78d3de42dcc9b49a04f683d2f9476e49904c29d4d19edf4a74ef33d

SHA512
f4156af1df1bdd485a3f27374d43bfb793f92fa6b3f5e7cc089b423726bba4c0abbab4cb938d80f48e3b3cd43ecf27e90a747371ce25b7473a3c8f30c496eddf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60415.exe

Filesize
468KB

MD5
51e2a9519635563320d480d8b324f83e

SHA1
ba693a8c0c156b05cdb72e6017851179b868d7e0

SHA256
8e48983947ee2ec381dd6dff221d702256206c3988cf9154bef29fc38066d76c

SHA512
097361b3f96e4746b2855a3c3858c1b52a9bbd63e95befab59ffc178fab14d04d40662e749076773f17e64a0524b3e8b572cde7b6d81a3b46bb281afc59b5549

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe

Filesize
468KB

MD5
2127f73e1b32a26fb02db25cdece1704

SHA1
6f3eb70a8d6dd41e6e6159e328e651aaccde2459

SHA256
bcfdcb708ced721f3c75f4f7e173fc735496eccb0a1082a72baece8cfef89e34

SHA512
bd26dc0a047fa8f3f097eb60dc250f3c2e8ed6a9b28ae6e3994799512c2b1916bf74fa22524c3e5f058ddd453d15546c80c6f44bff344bfbec3289191b8930ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62556.exe

Filesize
468KB

MD5
19b3018cdf8444f8d5289b34019d204b

SHA1
34fa8bb2fac2db51c2b734d79947499d7db5b02b

SHA256
39c5a8efd7960959668822abead0d524501ec7b9e253ae3bf3c049b230aa41ec

SHA512
3fb22d1781d265d114e7643ea43d86d7046e84d1052c6d8cdd2c61d9c8f1d6a7d9b928ae4159f92e52d5a00f33a0c3e40b5e0ddd4d28866a096dd807674403c1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe

Filesize
468KB

MD5
e30e84308ef0225f7ed3d6d985609c85

SHA1
d673817ea9f29afd4f7c03bd4179691ee48b1935

SHA256
3c7a77e9f6555e12b38a4d8cfdb64c4c3f8d1deec77973cbddbf9652cc666e91

SHA512
7c824c8d6be936803f53ce85f488324519ac189a403b3d0bafd208f190ce226a006247c60f0f8e086cc0f07ba6f2977a792ded7e0088e6324a8af5bd63e5c653

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe

Filesize
468KB

MD5
7668be65efb8f5f733df2e47be4cc97f

SHA1
9243bba8f25a4974ae9a5d758b8624f12eb13897

SHA256
1be26e9babd19a985c73dd51507ff2395df9230ccd932eb56ec5b9b4f0b31f22

SHA512
4f490c8e2bf0c8c96219c59796efde18dece189e1ce8a9ed27633375373500034899d8bbc3df9fb37fa68389b61d68eac631e1a54f5ae4745bf4b58babdcdcc7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe

Filesize
468KB

MD5
1844104d31c7f7acb2a317a84c64e71b

SHA1
ac18172f67dcb528bae14d42e8ba8cfe844c3b55

SHA256
bb446531c2de0f84ca638538b65cf32008375f9b183a846fa6c8e3fbcbb98d6e

SHA512
f97c5039400f4727a2f128ce76af334aecb8746a650503fab4f97ad9b404ccefcba9fb3d01cbd8a34587bbd8ad0615cf47843c7ce2c793cd6c3dd02b3bbf813c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33714.exe

Filesize
468KB

MD5
e4e8ff9a8ca122f40d83622795b6f719

SHA1
4f47f80d1cc50cbb8c1e21ad3ac877c093b45f82

SHA256
2ecee77ff924ab653f9f26e85311acf4554ddd4f864d062d7b6ab8246265bf01

SHA512
a7c81478afb50f51eeedf8dd4209364a67e7c0b48f0b681d4b16a456f6412c1f5cfebe65dd325a8b90a949581060eece21fcb06c3d61b9c291679c31566af006

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe

Filesize
468KB

MD5
fa97169b14917b4a7600685bdf4caf70

SHA1
84d4264beb71dd4470ad537dd0b052b255e0b3e0

SHA256
4e2094395bd63e795cb51977acb455ad5b0ed00abad30dbcc4eb2d1162584b7c

SHA512
fa27e52214a77548b2bf272985a9df1c7e950e517cdbc4f5588d204b6c0a4581787cc39b29bafcff361bba11e5343442c95e4545d913b74758e13e0a16c6b006

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe

Filesize
468KB

MD5
77cc4074c03a43069e3f5d00cadc3b5c

SHA1
14500423fe631b79f1740f243b9233bd006d12b7

SHA256
fba501e5eaed693d09e8d6d550aea6302c721f77b57875e10879a904a3be6d6c

SHA512
c41f7c376334490bd8d99fe0c515bcf6821a86a750020fe002b5b65adc42940b9f7d01982a9f32db8eafe36417cf931253e0d245261098b28bada499b4792720

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe

Filesize
468KB

MD5
0d52e6418db24792a67fc5c5937a7f81

SHA1
a5e945dd3105600e47de1305dd9758bf9171bb2d

SHA256
c072b30ea1fde12d2e0430efd1aff3af3fb13821569401fbbc3fa351148e20da

SHA512
22048f13a6b11c71db7bc197d00d85b19711b74cda2f68a2509cb98aa990ea58493aa08b5adfc9fedd253f5e8f3539bcf2f887e6b922959bc17f30c055e54cf1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe

Filesize
468KB

MD5
8c47ce1a202be7ab249ab83f790d6107

SHA1
019238bca59c58db199d58ebad48b70bb329e284

SHA256
75e079f17811a6a3b9ecff2b768d8c226d76d4a8a0eca72a6e96a2b6155edd8f

SHA512
22cc85bceb00f3c9165cecb1cbbe9de8957b14681fd6b94747ce6e53bbd25a7fb12b9db85e2731662fa9ec3c8e3b924001afbb68e38a58c97ddaf7a0a77274c8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe

Filesize
468KB

MD5
e78b9039a6275179df30652b93e4a02d

SHA1
ab29f17aa82ac400ef46d52536a5c3dd95b600b6

SHA256
ace2ee68a6535f5a6690f88be273af119fafac3417fd2ec720fc4f9651512895

SHA512
646fe5878cad0889819584007456fdf336859e185fc92ebf64e55e475568ad44e6869b6533b2ac543f21b98ed9fe218bd408018b959b1323b94c569fb72b607f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50339.exe

Filesize
468KB

MD5
606671ee10ff923f30580e8c28f5cda0

SHA1
b131e457d60f5ab614bf755508c1b1eda2b4707e

SHA256
91e67674c4d3b59d6c498f63dc2a6a445adf3c222b6df9591287df2da726a8a3

SHA512
2fb8fad2bf13a2077c9315689023e2efac349e68cd03174ed6aa6cf8b4ee3da3060b1da3c8a1dce5baa0fc553c010287a42f690041772c0d590a1f7d4e081147

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-551.exe

Filesize
468KB

MD5
e1fb6af06416989dd2abc5e74edb98ce

SHA1
30c95872a5189d1ed5fc45195252f45b25e9f4af

SHA256
f316a03e7031a650b1e8c33491bc440c36342f501c83fb9188140c9b2e4054a4

SHA512
58fedf324c025b20241e8a34174aaaee4bd4e2814ca6837001a114215099465275ddb4bf0cba4eb5d61e7cadacf787d04646a65500414fc858af436d84112152

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61216.exe

Filesize
468KB

MD5
0371bacffd1be8dc2245e1176ef19b14

SHA1
2932ac4ef982f18fc46a0bbb48111f9a8b2daf57

SHA256
37ccc0ec10c9822473dd4e4f59cf17c0b5bc9abf6ad9a538cd5c9bf5ea220ca1

SHA512
99491a587377143f2c16d3afc958be54342a3d321224b52006abf3e4162bc76a852942282cd78bce2a79eab52925978740156a0ea7075e14ced7272ded231905

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe

Filesize
468KB

MD5
3850bfbc001c61d539eaf7605836a909

SHA1
b692ec0e6b7e75d8349ac09d1702def12794403a

SHA256
4f258331a4b7f5fe374277fcfd476f09082135b2680176e258fd6bac629614ab

SHA512
dab6eda0255589f2bd1bc094ab7158ab1f5a56b10386b43cfa3b4aec3fabfab4124f0b549f502f842a779a008d6e54b5bb7f9826eb79e15ab8fa88a220f26453

Download Submit
memory/288-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/460-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/544-231-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/544-238-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/544-417-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/544-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/544-418-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/688-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/764-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-285-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1212-152-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1212-354-0x0000000002B30000-0x0000000002BA5000-memory.dmp

Filesize
468KB

Download
memory/1212-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-367-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1212-157-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1212-54-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1212-283-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1212-24-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/1212-23-0x0000000002B30000-0x0000000002BA5000-memory.dmp

Filesize
468KB

Download
memory/1444-149-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-311-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/1484-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-406-0x0000000002390000-0x0000000002405000-memory.dmp

Filesize
468KB

Download
memory/1532-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-359-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/1600-188-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/1600-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-187-0x0000000000550000-0x00000000005C5000-memory.dmp

Filesize
468KB

Download
memory/1628-266-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/1628-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-267-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/1724-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-222-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/1768-200-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/1932-289-0x0000000003100000-0x0000000003175000-memory.dmp

Filesize
468KB

Download
memory/1932-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-293-0x0000000003100000-0x0000000003175000-memory.dmp

Filesize
468KB

Download
memory/1936-284-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/1936-281-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/1936-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-221-0x0000000002330000-0x00000000023A5000-memory.dmp

Filesize
468KB

Download
memory/2156-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-106-0x0000000002330000-0x00000000023A5000-memory.dmp

Filesize
468KB

Download
memory/2156-204-0x0000000002330000-0x00000000023A5000-memory.dmp

Filesize
468KB

Download
memory/2156-46-0x0000000002330000-0x00000000023A5000-memory.dmp

Filesize
468KB

Download
memory/2156-399-0x0000000002330000-0x00000000023A5000-memory.dmp

Filesize
468KB

Download
memory/2156-400-0x0000000002330000-0x00000000023A5000-memory.dmp

Filesize
468KB

Download
memory/2244-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-141-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2324-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-302-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2324-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-146-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2336-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-370-0x00000000006F0000-0x0000000000765000-memory.dmp

Filesize
468KB

Download
memory/2336-369-0x00000000006F0000-0x0000000000765000-memory.dmp

Filesize
468KB

Download
memory/2380-6-0x00000000033A0000-0x0000000003415000-memory.dmp

Filesize
468KB

Download
memory/2380-162-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2380-169-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2380-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-314-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2380-322-0x00000000033A0000-0x0000000003415000-memory.dmp

Filesize
468KB

Download
memory/2380-340-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/2380-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2444-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-347-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/2480-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-348-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2568-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2672-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-257-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2752-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-258-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/2772-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-398-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2792-229-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2792-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-239-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2848-95-0x0000000002970000-0x00000000029E5000-memory.dmp

Filesize
468KB

Download
memory/2848-219-0x0000000002770000-0x00000000027E5000-memory.dmp

Filesize
468KB

Download
memory/2848-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-379-0x0000000002770000-0x00000000027E5000-memory.dmp

Filesize
468KB

Download
memory/2848-201-0x0000000002770000-0x00000000027E5000-memory.dmp

Filesize
468KB

Download
memory/2848-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-316-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2892-142-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2892-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-323-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2984-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download