a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766c

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
Size

468KB
MD5

152d67346a16672f596504d8186c8860
SHA1

1a55c06955238b98f34ab4152ff4e0fb60c25a84
SHA256

a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766c
SHA512

e81ebf0fec495c7fe2efec3d5c105e977f97dc6683beb75a8b86618ce8afeef629388a9a9ae6aba7dbbdd5a03590fdc2640e4e48e7d46f3ebee0bdba08bd643c
SSDEEP

3072:OQoHogIKI05QtbYJHzcOcfr/GChzP0pPnLHeaVPOswQLaX2gyKWq:OQIoD8QtOH4OcfxYSvswao2gy

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2088	Unicorn-22880.exe
3068	Unicorn-6673.exe
1752	Unicorn-56429.exe
2684	Unicorn-20331.exe
2708	Unicorn-32029.exe
1644	Unicorn-40197.exe
2596	Unicorn-62655.exe
2984	Unicorn-17120.exe
1540	Unicorn-23241.exe
2004	Unicorn-29372.exe
872	Unicorn-49792.exe
1984	Unicorn-29926.exe
1596	Unicorn-57695.exe
1404	Unicorn-57960.exe
1952	Unicorn-43330.exe
3004	Unicorn-23363.exe
2084	Unicorn-63253.exe
2216	Unicorn-6149.exe
840	Unicorn-26186.exe
2856	Unicorn-2236.exe
1932	Unicorn-22102.exe
1672	Unicorn-42522.exe
912	Unicorn-26740.exe
348	Unicorn-30824.exe
1948	Unicorn-58858.exe
2412	Unicorn-16163.exe
2348	Unicorn-26378.exe
2916	Unicorn-6512.exe
2080	Unicorn-34546.exe
708	Unicorn-57004.exe
3040	Unicorn-54204.exe
2336	Unicorn-23913.exe
2320	Unicorn-20383.exe
2312	Unicorn-47841.exe
2896	Unicorn-56009.exe
2764	Unicorn-36335.exe
2432	Unicorn-47271.exe
2704	Unicorn-33211.exe
2776	Unicorn-53077.exe
2796	Unicorn-48415.exe
2688	Unicorn-24416.exe
2548	Unicorn-45101.exe
2564	Unicorn-45101.exe
2632	Unicorn-63475.exe
2996	Unicorn-57524.exe
1512	Unicorn-11852.exe
264	Unicorn-44525.exe
2304	Unicorn-44525.exe
792	Unicorn-15937.exe
2040	Unicorn-52693.exe
2364	Unicorn-32827.exe
1088	Unicorn-49164.exe
1124	Unicorn-59911.exe
2620	Unicorn-19698.exe
2248	Unicorn-65137.exe
2884	Unicorn-63174.exe
280	Unicorn-7851.exe
2528	Unicorn-30309.exe
1332	Unicorn-36440.exe
1900	Unicorn-59282.exe
1812	Unicorn-36945.exe
1944	Unicorn-60511.exe
1128	Unicorn-25600.exe
2444	Unicorn-52151.exe

Loads dropped DLL 64 IoCs

pid	Process
3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
2088	Unicorn-22880.exe
2088	Unicorn-22880.exe
3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
3068	Unicorn-6673.exe
2088	Unicorn-22880.exe
2088	Unicorn-22880.exe
3068	Unicorn-6673.exe
1752	Unicorn-56429.exe
1752	Unicorn-56429.exe
3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
2684	Unicorn-20331.exe
2684	Unicorn-20331.exe
2088	Unicorn-22880.exe
2088	Unicorn-22880.exe
1644	Unicorn-40197.exe
1644	Unicorn-40197.exe
2596	Unicorn-62655.exe
2596	Unicorn-62655.exe
1752	Unicorn-56429.exe
1752	Unicorn-56429.exe
2708	Unicorn-32029.exe
3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
2708	Unicorn-32029.exe
3068	Unicorn-6673.exe
3068	Unicorn-6673.exe
1540	Unicorn-23241.exe
1540	Unicorn-23241.exe
2088	Unicorn-22880.exe
2088	Unicorn-22880.exe
2004	Unicorn-29372.exe
2004	Unicorn-29372.exe
1644	Unicorn-40197.exe
1644	Unicorn-40197.exe
2984	Unicorn-17120.exe
2984	Unicorn-17120.exe
872	Unicorn-49792.exe
872	Unicorn-49792.exe
1952	Unicorn-43330.exe
1952	Unicorn-43330.exe
2596	Unicorn-62655.exe
2596	Unicorn-62655.exe
2684	Unicorn-20331.exe
2684	Unicorn-20331.exe
1404	Unicorn-57960.exe
1404	Unicorn-57960.exe
3068	Unicorn-6673.exe
3068	Unicorn-6673.exe
2708	Unicorn-32029.exe
1596	Unicorn-57695.exe
1596	Unicorn-57695.exe
2708	Unicorn-32029.exe
1984	Unicorn-29926.exe
1984	Unicorn-29926.exe
1752	Unicorn-56429.exe
1752	Unicorn-56429.exe
3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
3004	Unicorn-23363.exe
3004	Unicorn-23363.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5484	5508	WerFault.exe	438

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62453.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
2088	Unicorn-22880.exe
3068	Unicorn-6673.exe
1752	Unicorn-56429.exe
2684	Unicorn-20331.exe
2708	Unicorn-32029.exe
1644	Unicorn-40197.exe
2596	Unicorn-62655.exe
2984	Unicorn-17120.exe
1540	Unicorn-23241.exe
872	Unicorn-49792.exe
2004	Unicorn-29372.exe
1404	Unicorn-57960.exe
1952	Unicorn-43330.exe
1984	Unicorn-29926.exe
1596	Unicorn-57695.exe
3004	Unicorn-23363.exe
2216	Unicorn-6149.exe
2084	Unicorn-63253.exe
2856	Unicorn-2236.exe
1932	Unicorn-22102.exe
840	Unicorn-26186.exe
1672	Unicorn-42522.exe
912	Unicorn-26740.exe
348	Unicorn-30824.exe
1948	Unicorn-58858.exe
2348	Unicorn-26378.exe
708	Unicorn-57004.exe
2080	Unicorn-34546.exe
2412	Unicorn-16163.exe
2916	Unicorn-6512.exe
3040	Unicorn-54204.exe
2320	Unicorn-20383.exe
2312	Unicorn-47841.exe
2896	Unicorn-56009.exe
2764	Unicorn-36335.exe
2432	Unicorn-47271.exe
2776	Unicorn-53077.exe
2704	Unicorn-33211.exe
2796	Unicorn-48415.exe
2688	Unicorn-24416.exe
2548	Unicorn-45101.exe
2564	Unicorn-45101.exe
2632	Unicorn-63475.exe
2304	Unicorn-44525.exe
1512	Unicorn-11852.exe
264	Unicorn-44525.exe
2996	Unicorn-57524.exe
2040	Unicorn-52693.exe
2364	Unicorn-32827.exe
792	Unicorn-15937.exe
1088	Unicorn-49164.exe
1124	Unicorn-59911.exe
2620	Unicorn-19698.exe
2248	Unicorn-65137.exe
2884	Unicorn-63174.exe
1332	Unicorn-36440.exe
2528	Unicorn-30309.exe
280	Unicorn-7851.exe
1900	Unicorn-59282.exe
2592	Unicorn-32307.exe
1944	Unicorn-60511.exe
1812	Unicorn-36945.exe
1128	Unicorn-25600.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2088	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	31
PID 3024 wrote to memory of 2088	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	31
PID 3024 wrote to memory of 2088	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	31
PID 3024 wrote to memory of 2088	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	31
PID 2088 wrote to memory of 3068	2088	Unicorn-22880.exe	32
PID 2088 wrote to memory of 3068	2088	Unicorn-22880.exe	32
PID 2088 wrote to memory of 3068	2088	Unicorn-22880.exe	32
PID 2088 wrote to memory of 3068	2088	Unicorn-22880.exe	32
PID 3024 wrote to memory of 1752	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	33
PID 3024 wrote to memory of 1752	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	33
PID 3024 wrote to memory of 1752	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	33
PID 3024 wrote to memory of 1752	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	33
PID 2088 wrote to memory of 2684	2088	Unicorn-22880.exe	35
PID 2088 wrote to memory of 2684	2088	Unicorn-22880.exe	35
PID 2088 wrote to memory of 2684	2088	Unicorn-22880.exe	35
PID 2088 wrote to memory of 2684	2088	Unicorn-22880.exe	35
PID 3068 wrote to memory of 2708	3068	Unicorn-6673.exe	34
PID 3068 wrote to memory of 2708	3068	Unicorn-6673.exe	34
PID 3068 wrote to memory of 2708	3068	Unicorn-6673.exe	34
PID 3068 wrote to memory of 2708	3068	Unicorn-6673.exe	34
PID 1752 wrote to memory of 1644	1752	Unicorn-56429.exe	36
PID 1752 wrote to memory of 1644	1752	Unicorn-56429.exe	36
PID 1752 wrote to memory of 1644	1752	Unicorn-56429.exe	36
PID 1752 wrote to memory of 1644	1752	Unicorn-56429.exe	36
PID 3024 wrote to memory of 2596	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	37
PID 3024 wrote to memory of 2596	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	37
PID 3024 wrote to memory of 2596	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	37
PID 3024 wrote to memory of 2596	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	37
PID 2684 wrote to memory of 2984	2684	Unicorn-20331.exe	38
PID 2684 wrote to memory of 2984	2684	Unicorn-20331.exe	38
PID 2684 wrote to memory of 2984	2684	Unicorn-20331.exe	38
PID 2684 wrote to memory of 2984	2684	Unicorn-20331.exe	38
PID 2088 wrote to memory of 1540	2088	Unicorn-22880.exe	39
PID 2088 wrote to memory of 1540	2088	Unicorn-22880.exe	39
PID 2088 wrote to memory of 1540	2088	Unicorn-22880.exe	39
PID 2088 wrote to memory of 1540	2088	Unicorn-22880.exe	39
PID 1644 wrote to memory of 2004	1644	Unicorn-40197.exe	40
PID 1644 wrote to memory of 2004	1644	Unicorn-40197.exe	40
PID 1644 wrote to memory of 2004	1644	Unicorn-40197.exe	40
PID 1644 wrote to memory of 2004	1644	Unicorn-40197.exe	40
PID 2596 wrote to memory of 872	2596	Unicorn-62655.exe	41
PID 2596 wrote to memory of 872	2596	Unicorn-62655.exe	41
PID 2596 wrote to memory of 872	2596	Unicorn-62655.exe	41
PID 2596 wrote to memory of 872	2596	Unicorn-62655.exe	41
PID 1752 wrote to memory of 1984	1752	Unicorn-56429.exe	42
PID 1752 wrote to memory of 1984	1752	Unicorn-56429.exe	42
PID 1752 wrote to memory of 1984	1752	Unicorn-56429.exe	42
PID 1752 wrote to memory of 1984	1752	Unicorn-56429.exe	42
PID 3024 wrote to memory of 1596	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	44
PID 3024 wrote to memory of 1596	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	44
PID 3024 wrote to memory of 1596	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	44
PID 3024 wrote to memory of 1596	3024	a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe	44
PID 2708 wrote to memory of 1404	2708	Unicorn-32029.exe	43
PID 2708 wrote to memory of 1404	2708	Unicorn-32029.exe	43
PID 2708 wrote to memory of 1404	2708	Unicorn-32029.exe	43
PID 2708 wrote to memory of 1404	2708	Unicorn-32029.exe	43
PID 3068 wrote to memory of 1952	3068	Unicorn-6673.exe	45
PID 3068 wrote to memory of 1952	3068	Unicorn-6673.exe	45
PID 3068 wrote to memory of 1952	3068	Unicorn-6673.exe	45
PID 3068 wrote to memory of 1952	3068	Unicorn-6673.exe	45
PID 1540 wrote to memory of 3004	1540	Unicorn-23241.exe	46
PID 1540 wrote to memory of 3004	1540	Unicorn-23241.exe	46
PID 1540 wrote to memory of 3004	1540	Unicorn-23241.exe	46
PID 1540 wrote to memory of 3004	1540	Unicorn-23241.exe	46

C:\Users\Admin\AppData\Local\Temp\a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe
"C:\Users\Admin\AppData\Local\Temp\a2a9edf4837b2d14470bf658d7855c2fc287d1d20759fcbd9d364b0f8801766cN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32029.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57960.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        8⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        9⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        9⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        9⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        9⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        9⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57200.exe
        8⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50562.exe
        8⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        8⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50516.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        8⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11973.exe
        7⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15515.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        7⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exe
        6⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        7⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33847.exe
        7⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        6⤵
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56100.exe
        7⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        7⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        7⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exe
        6⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58451.exe
        6⤵
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        6⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31226.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21401.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        5⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15937.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34720.exe
        7⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        8⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        8⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18537.exe
        8⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
        8⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        6⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6981.exe
        7⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        6⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        6⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        7⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
        6⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48759.exe
        6⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exe
        6⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3748.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        5⤵
        
        PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12916.exe
        5⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        5⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16163.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        6⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        5⤵
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        5⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39038.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60875.exe
      4⤵
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44210.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55967.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61318.exe
      4⤵
      PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26186.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45101.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23236.exe
        7⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        7⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23982.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8195.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        6⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43848.exe
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14526.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        6⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        6⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56380.exe
        5⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49289.exe
        5⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25099.exe
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30824.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        6⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        7⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6680.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12172.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22638.exe
        5⤵
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15040.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50475.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4268.exe
        5⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33468.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        5⤵
        
        PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4003.exe
      4⤵
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5796.exe
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exe
      4⤵
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        5⤵
        Executes dropped EXE
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        7⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51902.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        7⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32337.exe
        6⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5060.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51067.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7267.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe
        5⤵
        
        PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        5⤵
        
        PID:5508
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5508 -s 188
        6⤵
        Program crash
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60511.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2291.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50376.exe
        5⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50562.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25600.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50681.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64517.exe
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
      4⤵
      PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56009.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28248.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50562.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        6⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41792.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8208.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
      4⤵
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
      4⤵
      PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
      4⤵
      PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61855.exe
      4⤵
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12680.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30133.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6680.exe
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48799.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
      4⤵
      PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42546.exe
      4⤵
      PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4496.exe
      4⤵
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
    3⤵
    PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
    3⤵
    PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42666.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55071.exe
    3⤵
    PID:6668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56429.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56429.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40197.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29372.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47841.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52151.exe
        7⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4704.exe
        8⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exe
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        8⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        8⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        7⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46666.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        7⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        7⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
        6⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        6⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        7⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        7⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        7⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        6⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        6⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35483.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31226.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45101.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46588.exe
        6⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39009.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exe
        7⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64823.exe
        5⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41690.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        6⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4673.exe
        5⤵
        
        PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19919.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        5⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
      4⤵
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe
      4⤵
      PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21316.exe
        6⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62758.exe
        7⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        7⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        7⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe
        5⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11102.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36592.exe
        5⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        6⤵
        
        PID:952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        5⤵
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37718.exe
      4⤵
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        5⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        5⤵
        
        PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        5⤵
        
        PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
      4⤵
      PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
      4⤵
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8763.exe
      4⤵
      PID:5244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exe
      4⤵
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12680.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56927.exe
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        5⤵
        
        PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exe
      4⤵
      PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24416.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
        5⤵
        
        PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        5⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        5⤵
        
        PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59198.exe
      4⤵
      PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
      4⤵
      PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
      4⤵
      PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25789.exe
    3⤵
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
      4⤵
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
      4⤵
      PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
      4⤵
      PID:5304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51600.exe
    3⤵
    PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
    3⤵
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
    3⤵
    PID:5040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47503.exe
    3⤵
    PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
    3⤵
    PID:6292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18379.exe
        6⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58321.exe
        5⤵
        
        PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63775.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        5⤵
        
        PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50328.exe
      4⤵
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18379.exe
        5⤵
        
        PID:276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34098.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58874.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
      4⤵
      PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
      4⤵
      PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4268.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        5⤵
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
      4⤵
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
      4⤵
      PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
      4⤵
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8208.exe
      4⤵
      PID:7080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4268.exe
      4⤵
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        5⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        5⤵
        
        PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
      4⤵
      PID:6972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
    3⤵
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exe
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
    3⤵
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
    3⤵
    PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
    3⤵
    PID:6676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26378.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exe
        5⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20836.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5389.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3245.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
      4⤵
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35291.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
      4⤵
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42369.exe
      4⤵
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        5⤵
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26244.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
      4⤵
      PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
      4⤵
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
      4⤵
      PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
    3⤵
    PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exe
    3⤵
    PID:3808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
    3⤵
    PID:4312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65332.exe
    3⤵
    PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10390.exe
    3⤵
    PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exe
    3⤵
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
    3⤵
    PID:4320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe
    3⤵
    PID:4736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65332.exe
    3⤵
    PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
    3⤵
    PID:6720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exe
    3⤵
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
      4⤵
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20183.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
      4⤵
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
      4⤵
      PID:7064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48482.exe
    3⤵
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
    3⤵
    PID:3816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61011.exe
    3⤵
    PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exe
    3⤵
    PID:6344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
  2⤵
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
    3⤵
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
    3⤵
    PID:6644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
  2⤵
  PID:3268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
  2⤵
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
  2⤵
  PID:5996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43565.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43565.exe
  2⤵
  PID:6428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe

Filesize
468KB

MD5
d79c0fd0fd84be5c1769c2466fae03de

SHA1
a3001ffa099b263d5369d80fab49cb7b2aa5c38e

SHA256
667e0c6708e5264b5aef52194a492ecf5f90b73ca6dae7f21c199788ed0d0a80

SHA512
2f3c9f741cb800ffcdfe112f1e5cbf11af0cb20085bf443f18368a511de1ff60151250b3beaadc6dcd79cc20de03378fd0ff93fc7ff2a42e4cc23cb0e4443c64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe

Filesize
468KB

MD5
064ea707fb6422ba7a18266e548fd6f9

SHA1
01a08b7f36a5a92ba677335b8dc59c98804ae414

SHA256
6f329150d8fc3448abbfc79bcd268b706a87ea3fac67a1a5e45233926379df97

SHA512
3d7176ff41bcdb7e3b84d681ffcd9db34585a4bc2398c398d3d82e5443c96ce48a83e573a4b551a423189bf3f0bcb079973ac30c3bb6dd0706a0bad92ba13e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe

Filesize
468KB

MD5
99b91e206854536f96f88a174a4d4bfa

SHA1
9d8b76bf8d3f256ea28d11489c23ee9faf7b5690

SHA256
b0d58a01215eecbdab047f04c5a1f53df204dd3717a3c7dc5e208aae14dbab92

SHA512
65ab26c96dc6876d9d76fafdd557814dc8f06f05f6972f52dd52cd18e89d84713a2a26b835a6f727195076bbefa1b35495d5575f6af192fd191da4f5de3d8672

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe

Filesize
468KB

MD5
a0d005e4271b4b874ea93416ee06582c

SHA1
c94bd6c24cb4308e4b591dc5cc71e44d233258d9

SHA256
4fbaf2b6c8070b6c2ef9b21b6a3c0ef3d8ba9e178fe1297557bf69f47c7a7e81

SHA512
5b96b7b8829db22981d82c21dd1bbac2b3bebe3ac8a557639e55817c0169f8671aff2914dfcc2fe57868c09229b6a43dbb6104c48954b1b49a087e0dfb7b4ac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe

Filesize
468KB

MD5
d6a24fd26f5c5cc3cafa072cff136bf7

SHA1
b71ba0b0e458578a79bc47ec4f3b201249f4b49b

SHA256
9605702a28684a446514ad5f4a8d9a888ea6bf51bc9637cf3414db19c4771d7d

SHA512
7fd26a3e8de59eaceda8a2f254c9c6d8ae14c20653745850cc214e7c78024849d7666030549ce7e67bfd0e9509f78a5d64e08865e3b2584f3e9766fcf4352908

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe

Filesize
468KB

MD5
4905d5a57430af47926d1b58749ef562

SHA1
a2f9f9e6b08b31026c247b1ac366d3d2d10771e3

SHA256
c842024caaa1a0e114fde1de803ee5416bb1e0fa17b85306c747f4956a30269c

SHA512
abb0f401b681e8207b408c74b2876c46d7afeee2056c2418bd620e1240c077e58d9487b9fdae92f45e53986fdf395d07dba0bb0f70e03703ebfc9559c7750d95

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe

Filesize
468KB

MD5
11148c49ea288b7161625855fdea4f21

SHA1
78b7314c600612bfe2533113377e6b926f650c63

SHA256
c536ad5918a1c824a34a7d2ef9c647e1e246052a28f976dc29aceb2c631ba83a

SHA512
d7fca036c3054ce1c8e8baee9db64d260b1286a1d2e94549f34eee41c0d8aedfcb302dbc6ad0be0a1ccb6c592cb625a9c9eb8669f0e13a5e6676b9d9b743ea7d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe

Filesize
468KB

MD5
694b4cbd4890aef31f19bcde64a14966

SHA1
e99c71fdc0026b018d2396485bc52e9b79c1d156

SHA256
9ce0e769580649c131454506e2b2a8b6c19607bfab8ebde6ae5f70d60af76b51

SHA512
8a90dd8c65b71d1c57e96ab94d3bc1a4fa40337bfd20136241835b1adf333fec76351284fb9af3b150545418786d31b6b3f89321d1c2608c3fa94edc797f0285

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe

Filesize
468KB

MD5
7f9993f7a98e5be68e5626f0b8e2c320

SHA1
8d7efa55dc8daf476931a99e93ddb283f86222ee

SHA256
1cb96104dd8123d33094b357e85680bcac2393ff7d8bd6d95e4e378aad4a76de

SHA512
a98c6d6976656cdedefd649163c2d0d3ca2d4b81143865fae962bc3a511624aab0a7a0b7c876d74d26b1fadc932cd2a3b4c80c87e63c785529bfa6c4199389a5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe

Filesize
468KB

MD5
9b5d3fa1adfe65b74fcfcb6dfffc81db

SHA1
717141381e7d9d7327901b1af87dddccb3f9b5f7

SHA256
bab38cbb881427232d7720f0b2b0c9c0a03abbc33266f1b99182446a77f51c04

SHA512
7143d6e607e3d1ab89d7d8353752dd39f16e6bbbc95794960709a23cccdccbdd68bde0b88fd2ca1598adf2d4bffb78dd3fc0efb99e3e7658a6298165cbe22b6e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29372.exe

Filesize
468KB

MD5
5a17c21e40bd3080268ecdd32543cc28

SHA1
cf609870890b858928f4b2819ef88279172e3203

SHA256
c2825554946b960238c74ac4cf4bf75efc9b3a4fac12cdb5f6a759c0dc78838f

SHA512
7fac891fe5eb797de0df8b5f0ff5badfbfbd15f482fd0b59f3d0b4dd62531913670f536e003e01927ba8949e522d0d0188a5dfa913422c008acabbcdd49d4e07

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32029.exe

Filesize
468KB

MD5
6f1ba84cbee898152c8726ee3e80c909

SHA1
36e5a2826666b04d0c07bdb648295f906e0aba70

SHA256
140d1f5805e75152380da326f3e4f0fbd7af055f940a189561b872ac66e86ce9

SHA512
ef743efe828ac99cda2f0d6fe057e1201593fab3325090ba6bb90633e615f8fbbd972ee7134e027b5f3a4435d1770154eaa26370a9456f12cd19dfe3c127ff78

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40197.exe

Filesize
468KB

MD5
2fabb26b238cc4930196816e690c643c

SHA1
d23614b04ee2fad1fce4c1bca93b566400def882

SHA256
5f23ffe7b026b784afb9dac1c0791341e34bde7fa30fc785a0e37084dd1ecf82

SHA512
cc5ddba516bd47f5e5ea719531708119a88831147006abfba1759aac8067785c4bb39cd5c9764cc0623b280154daca15021182730bb4281c35bacdd33245d1f9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe

Filesize
468KB

MD5
fd57ea231d2aef0f011eb09057af4e28

SHA1
915f517e8e2cbe3aebaaaac4a6b784dc730c25d1

SHA256
f484893026b0c243c17a4a09cb4a0332dd7f7621c151493638318823da25d33f

SHA512
f3654d86c23bca6d4f4492bf743bd037cf807b36bb5dbf62a4c74e95fd0b987a8edf510cb467a0769311155ff20778ca80d4a9838db8ee626b372754cd630b00

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe

Filesize
468KB

MD5
e1dec2a6c076a17fcef0a1951578b866

SHA1
d186c1d9ce4074a67368c861fbc0133a166a4898

SHA256
63efede8fc5c60725804a5d88bc04d46527db74bcd005bae748fc726dd572a53

SHA512
7e9bc9b133dfa5295a52c9fca77386e16f373e23b33a278b19de7e7ed424d05533bf67362f9b79609216c3f024151a7d96d096499ec523b5e14a19dae5e5dae9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56429.exe

Filesize
468KB

MD5
b9b3992cec42aa50defe7029afcbb1af

SHA1
916e0752850f66f9319a93ba36e12fd1d9da16c1

SHA256
09120fe815a248d3cde00351f586799707ae2e5b9adfde64089ab1ded386d1ae

SHA512
236c5c794f22543a6f3d26083713eec0ec06ea870bbc0f5eaeb39253945b28771dd216e8138957cee48a711cf4e2675f10c9c0f6f1450d1edea067b04b2790c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57960.exe

Filesize
468KB

MD5
692b8b5ac7c16d82a4ef62121e3c21b0

SHA1
e1ecf190dd92c33cd4923f536b8c09fe46764fd6

SHA256
48208cc351ec60fa60f8902d80c7c238b450d8191a3e9355902d61456315703a

SHA512
cbed1d952ebd064f9d119c896a2d2a42aa5cb474a30f30e8c3b0642719b30e0cdd092f3fc926312089bfe87c40f29b7fd9aaf347a10e2a41f9ac86f0579b419a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe

Filesize
468KB

MD5
c7614a8118c2bf827090ceb59b40d3cc

SHA1
f86e2ec14a70f6c60e83ea2e2f5bb072bde3b519

SHA256
b70a422eac6b5c7ce79a98a6f9343080a6fe3e6c2f2b09d78a0e4d71454b8b13

SHA512
8717abcc7130dcfa119b3b2859d3177865ca05dd7236d4720d90f62cb361636f53c0accdf2ccecccb24e0fbf8c25bdba3a549d8210f4feaff57c0759641e65bd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe

Filesize
468KB

MD5
86ec02b357ab8efb1c274c47f3fb279b

SHA1
659d8f501de5e126dd9000f661cd91c8b608b6ce

SHA256
5c84acaf9900263fa95a797b44a89a6d8f0a0fbfa2f17fecc96c4e8ef942ee45

SHA512
e08083db2329e353720d492991c224061c3a0e51d3164df55e78f17e9818be2d83dd1e661995d32a08595e3ec11b5be100b6d882252ee7d0c7a74d9c54564107

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe

Filesize
468KB

MD5
4c03a4df243533d2835783e69b113dcd

SHA1
f946b1db0b8281929a13b3e34c94bc6bc5d71af4

SHA256
70167c98ac5d2921a905d48b9a2d89aaa1c9c949f84704d8a8d0c39280e979c6

SHA512
0698e34381a24d2dcca8528e6db637f5ad52446e00b9504b1c06026f57b727410651b87554241fdbac61407456f7762e446c10fddb638a22467d95685b973f36

Download Submit