61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688d

Analysis

max time kernel
112s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
Size

468KB
MD5

d23e13451421613e24b7bed713f526e0
SHA1

1b20860764c91cfdf62ec28a1257facfdebe44fe
SHA256

61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688d
SHA512

d02ee0ad3981deaf678f7c65fcfebaa47fac77067e798685e710617337709b661ee7259a515fada0efb2e34e9a2ba67c61a9e416de207b15898dfec5ea4ac60e
SSDEEP

3072:ToA1ogYnI05ptbYXPz4jef8/ECxv1gpX/mHH6Vs/KYNTiGiul7lT:ToCom8pt0PEjefkcgnKYltiul

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2688	Unicorn-47063.exe
2704	Unicorn-3249.exe
2068	Unicorn-19512.exe
2684	Unicorn-60608.exe
2564	Unicorn-28512.exe
1512	Unicorn-8646.exe
2204	Unicorn-17555.exe
2280	Unicorn-45998.exe
2524	Unicorn-59895.exe
1164	Unicorn-49371.exe
2872	Unicorn-36372.exe
2140	Unicorn-876.exe
1772	Unicorn-611.exe
1616	Unicorn-13796.exe
484	Unicorn-49522.exe
1816	Unicorn-49827.exe
2956	Unicorn-21016.exe
1904	Unicorn-56725.exe
2100	Unicorn-33377.exe
2220	Unicorn-42392.exe
840	Unicorn-37793.exe
948	Unicorn-56097.exe
1064	Unicorn-10103.exe
2188	Unicorn-11806.exe
1536	Unicorn-33927.exe
1484	Unicorn-15374.exe
1644	Unicorn-21505.exe
1752	Unicorn-7799.exe
2984	Unicorn-62869.exe
1944	Unicorn-13692.exe
2632	Unicorn-61466.exe
344	Unicorn-61201.exe
1088	Unicorn-56396.exe
2736	Unicorn-36530.exe
1592	Unicorn-10350.exe
2520	Unicorn-4220.exe
2740	Unicorn-8274.exe
2760	Unicorn-55066.exe
2568	Unicorn-25836.exe
2620	Unicorn-21813.exe
2604	Unicorn-9006.exe
2588	Unicorn-14355.exe
1416	Unicorn-36713.exe
808	Unicorn-10019.exe
1916	Unicorn-18950.exe
2948	Unicorn-14735.exe
3024	Unicorn-62696.exe
2636	Unicorn-62696.exe
2856	Unicorn-28117.exe
2772	Unicorn-14382.exe
1804	Unicorn-6344.exe
1656	Unicorn-34440.exe
1176	Unicorn-34440.exe
2644	Unicorn-34440.exe
1732	Unicorn-28113.exe
2028	Unicorn-47849.exe
1280	Unicorn-31662.exe
2964	Unicorn-56863.exe
3056	Unicorn-47860.exe
664	Unicorn-25498.exe
2516	Unicorn-61207.exe
1100	Unicorn-61207.exe
1828	Unicorn-64917.exe
1932	Unicorn-64917.exe

Loads dropped DLL 64 IoCs

pid	Process
880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
2688	Unicorn-47063.exe
2688	Unicorn-47063.exe
880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
2704	Unicorn-3249.exe
2704	Unicorn-3249.exe
2068	Unicorn-19512.exe
2068	Unicorn-19512.exe
2688	Unicorn-47063.exe
2688	Unicorn-47063.exe
880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
2564	Unicorn-28512.exe
2564	Unicorn-28512.exe
2684	Unicorn-60608.exe
2684	Unicorn-60608.exe
2704	Unicorn-3249.exe
2704	Unicorn-3249.exe
2204	Unicorn-17555.exe
2204	Unicorn-17555.exe
880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
1512	Unicorn-8646.exe
880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
1512	Unicorn-8646.exe
2688	Unicorn-47063.exe
2688	Unicorn-47063.exe
2280	Unicorn-45998.exe
2280	Unicorn-45998.exe
2068	Unicorn-19512.exe
2068	Unicorn-19512.exe
2564	Unicorn-28512.exe
2564	Unicorn-28512.exe
2524	Unicorn-59895.exe
2524	Unicorn-59895.exe
2684	Unicorn-60608.exe
2684	Unicorn-60608.exe
2140	Unicorn-876.exe
2140	Unicorn-876.exe
1512	Unicorn-8646.exe
1512	Unicorn-8646.exe
1772	Unicorn-611.exe
1772	Unicorn-611.exe
2872	Unicorn-36372.exe
2872	Unicorn-36372.exe
880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
2204	Unicorn-17555.exe
2204	Unicorn-17555.exe
2704	Unicorn-3249.exe
2704	Unicorn-3249.exe
1616	Unicorn-13796.exe
1616	Unicorn-13796.exe
1164	Unicorn-49371.exe
1164	Unicorn-49371.exe
2688	Unicorn-47063.exe
2688	Unicorn-47063.exe
1816	Unicorn-49827.exe
1816	Unicorn-49827.exe
484	Unicorn-49522.exe
2068	Unicorn-19512.exe
484	Unicorn-49522.exe
2068	Unicorn-19512.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3584	3292	WerFault.exe	249

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7548.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
2688	Unicorn-47063.exe
2704	Unicorn-3249.exe
2068	Unicorn-19512.exe
2684	Unicorn-60608.exe
2564	Unicorn-28512.exe
1512	Unicorn-8646.exe
2204	Unicorn-17555.exe
2280	Unicorn-45998.exe
2524	Unicorn-59895.exe
1164	Unicorn-49371.exe
1616	Unicorn-13796.exe
2140	Unicorn-876.exe
2872	Unicorn-36372.exe
1772	Unicorn-611.exe
1816	Unicorn-49827.exe
484	Unicorn-49522.exe
1904	Unicorn-56725.exe
2956	Unicorn-21016.exe
2100	Unicorn-33377.exe
2220	Unicorn-42392.exe
840	Unicorn-37793.exe
948	Unicorn-56097.exe
1064	Unicorn-10103.exe
1536	Unicorn-33927.exe
2188	Unicorn-11806.exe
1484	Unicorn-15374.exe
1752	Unicorn-7799.exe
1644	Unicorn-21505.exe
2984	Unicorn-62869.exe
1944	Unicorn-13692.exe
2632	Unicorn-61466.exe
344	Unicorn-61201.exe
2736	Unicorn-36530.exe
1088	Unicorn-56396.exe
1592	Unicorn-10350.exe
2520	Unicorn-4220.exe
2740	Unicorn-8274.exe
2760	Unicorn-55066.exe
2568	Unicorn-25836.exe
2604	Unicorn-9006.exe
2620	Unicorn-21813.exe
2588	Unicorn-14355.exe
808	Unicorn-10019.exe
1416	Unicorn-36713.exe
1916	Unicorn-18950.exe
2948	Unicorn-14735.exe
3024	Unicorn-62696.exe
2636	Unicorn-62696.exe
2856	Unicorn-28117.exe
1804	Unicorn-6344.exe
2772	Unicorn-14382.exe
1656	Unicorn-34440.exe
1176	Unicorn-34440.exe
2644	Unicorn-34440.exe
1732	Unicorn-28113.exe
2028	Unicorn-47849.exe
2964	Unicorn-56863.exe
1280	Unicorn-31662.exe
3056	Unicorn-47860.exe
664	Unicorn-25498.exe
1100	Unicorn-61207.exe
2516	Unicorn-61207.exe
1828	Unicorn-64917.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 2688	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	30
PID 880 wrote to memory of 2688	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	30
PID 880 wrote to memory of 2688	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	30
PID 880 wrote to memory of 2688	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	30
PID 2688 wrote to memory of 2704	2688	Unicorn-47063.exe	31
PID 2688 wrote to memory of 2704	2688	Unicorn-47063.exe	31
PID 2688 wrote to memory of 2704	2688	Unicorn-47063.exe	31
PID 2688 wrote to memory of 2704	2688	Unicorn-47063.exe	31
PID 880 wrote to memory of 2068	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	32
PID 880 wrote to memory of 2068	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	32
PID 880 wrote to memory of 2068	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	32
PID 880 wrote to memory of 2068	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	32
PID 2704 wrote to memory of 2684	2704	Unicorn-3249.exe	33
PID 2704 wrote to memory of 2684	2704	Unicorn-3249.exe	33
PID 2704 wrote to memory of 2684	2704	Unicorn-3249.exe	33
PID 2704 wrote to memory of 2684	2704	Unicorn-3249.exe	33
PID 2068 wrote to memory of 2564	2068	Unicorn-19512.exe	34
PID 2068 wrote to memory of 2564	2068	Unicorn-19512.exe	34
PID 2068 wrote to memory of 2564	2068	Unicorn-19512.exe	34
PID 2068 wrote to memory of 2564	2068	Unicorn-19512.exe	34
PID 2688 wrote to memory of 1512	2688	Unicorn-47063.exe	35
PID 2688 wrote to memory of 1512	2688	Unicorn-47063.exe	35
PID 2688 wrote to memory of 1512	2688	Unicorn-47063.exe	35
PID 2688 wrote to memory of 1512	2688	Unicorn-47063.exe	35
PID 880 wrote to memory of 2204	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	36
PID 880 wrote to memory of 2204	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	36
PID 880 wrote to memory of 2204	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	36
PID 880 wrote to memory of 2204	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	36
PID 2564 wrote to memory of 2280	2564	Unicorn-28512.exe	37
PID 2564 wrote to memory of 2280	2564	Unicorn-28512.exe	37
PID 2564 wrote to memory of 2280	2564	Unicorn-28512.exe	37
PID 2564 wrote to memory of 2280	2564	Unicorn-28512.exe	37
PID 2684 wrote to memory of 2524	2684	Unicorn-60608.exe	38
PID 2684 wrote to memory of 2524	2684	Unicorn-60608.exe	38
PID 2684 wrote to memory of 2524	2684	Unicorn-60608.exe	38
PID 2684 wrote to memory of 2524	2684	Unicorn-60608.exe	38
PID 2704 wrote to memory of 1164	2704	Unicorn-3249.exe	39
PID 2704 wrote to memory of 1164	2704	Unicorn-3249.exe	39
PID 2704 wrote to memory of 1164	2704	Unicorn-3249.exe	39
PID 2704 wrote to memory of 1164	2704	Unicorn-3249.exe	39
PID 2204 wrote to memory of 2872	2204	Unicorn-17555.exe	40
PID 2204 wrote to memory of 2872	2204	Unicorn-17555.exe	40
PID 2204 wrote to memory of 2872	2204	Unicorn-17555.exe	40
PID 2204 wrote to memory of 2872	2204	Unicorn-17555.exe	40
PID 880 wrote to memory of 1772	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	41
PID 880 wrote to memory of 1772	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	41
PID 880 wrote to memory of 1772	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	41
PID 880 wrote to memory of 1772	880	61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe	41
PID 1512 wrote to memory of 2140	1512	Unicorn-8646.exe	42
PID 1512 wrote to memory of 2140	1512	Unicorn-8646.exe	42
PID 1512 wrote to memory of 2140	1512	Unicorn-8646.exe	42
PID 1512 wrote to memory of 2140	1512	Unicorn-8646.exe	42
PID 2688 wrote to memory of 1616	2688	Unicorn-47063.exe	43
PID 2688 wrote to memory of 1616	2688	Unicorn-47063.exe	43
PID 2688 wrote to memory of 1616	2688	Unicorn-47063.exe	43
PID 2688 wrote to memory of 1616	2688	Unicorn-47063.exe	43
PID 2280 wrote to memory of 484	2280	Unicorn-45998.exe	44
PID 2280 wrote to memory of 484	2280	Unicorn-45998.exe	44
PID 2280 wrote to memory of 484	2280	Unicorn-45998.exe	44
PID 2280 wrote to memory of 484	2280	Unicorn-45998.exe	44
PID 2068 wrote to memory of 1816	2068	Unicorn-19512.exe	45
PID 2068 wrote to memory of 1816	2068	Unicorn-19512.exe	45
PID 2068 wrote to memory of 1816	2068	Unicorn-19512.exe	45
PID 2068 wrote to memory of 1816	2068	Unicorn-19512.exe	45

C:\Users\Admin\AppData\Local\Temp\61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe
"C:\Users\Admin\AppData\Local\Temp\61898bae3bd5325bd8f8b06be6aa9e25916d630f8d1b071b5254983ecc76688dN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47063.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47063.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3249.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60608.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64917.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1240.exe
        8⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        8⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        8⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe
        7⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23648.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44439.exe
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
        7⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        7⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        8⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9709.exe
        7⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53980.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        7⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        7⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47649.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        7⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        6⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14982.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64992.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4617.exe
        6⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        8⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        8⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        8⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
        7⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53980.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39120.exe
        6⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        7⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        7⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        6⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39291.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12987.exe
        6⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51879.exe
        7⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62645.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
        7⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64167.exe
        6⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        5⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        6⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
        5⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53665.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26756.exe
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32777.exe
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        7⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 188
        8⤵
        Program crash
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        7⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1310.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14735.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58986.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        7⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-519.exe
        6⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42680.exe
        5⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58150.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33882.exe
        5⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15374.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34440.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35309.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        7⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17782.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        5⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        6⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        6⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12213.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
      4⤵
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36687.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
      4⤵
      PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
      4⤵
      PID:6624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42392.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25836.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        8⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        8⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        8⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        7⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39045.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        7⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe
        6⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        7⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        7⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        6⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        5⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        6⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
        6⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        5⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14982.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        5⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        5⤵
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37793.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9006.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48758.exe
        6⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        7⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        6⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        6⤵
        
        PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7429.exe
        5⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42903.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48036.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40905.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        6⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        5⤵
        
        PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        5⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42435.exe
        5⤵
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
      4⤵
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63984.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44969.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54404.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21505.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        6⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        7⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        7⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23456.exe
        6⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        6⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        5⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62136.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37377.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7940.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        5⤵
        
        PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41060.exe
        5⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27796.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
      4⤵
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        5⤵
        
        PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34840.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe
      4⤵
      PID:6396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36713.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25051.exe
        5⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10888.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        6⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53867.exe
      4⤵
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        5⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exe
      4⤵
      PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
      4⤵
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
      4⤵
      PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
    3⤵
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
      4⤵
      PID:6996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48084.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
    3⤵
    PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
    3⤵
    PID:6868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        8⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        8⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        8⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
        7⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe
        7⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64917.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        7⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        7⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36548.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61264.exe
        6⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        7⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        7⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47104.exe
        6⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17782.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3218.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        6⤵
        
        PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14205.exe
        5⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14104.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
        5⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4617.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21016.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41052.exe
        6⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63861.exe
        7⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63604.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40375.exe
        7⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39693.exe
        6⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44667.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        6⤵
        
        PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5125.exe
        5⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        6⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        5⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4220.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32785.exe
        5⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26098.exe
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7884.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43996.exe
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11802.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9868.exe
        5⤵
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        5⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58117.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
      4⤵
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52968.exe
      4⤵
      PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49827.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
        6⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        5⤵
        
        PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17782.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
        5⤵
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        5⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        5⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10409.exe
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1410.exe
      4⤵
      PID:292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
      4⤵
      PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
      4⤵
      PID:6516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61201.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        6⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        6⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53112.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44504.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11698.exe
      4⤵
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        5⤵
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7207.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23915.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30921.exe
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
      4⤵
      PID:6924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
    3⤵
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
      4⤵
      PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47239.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
    3⤵
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15512.exe
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23438.exe
    3⤵
    PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
    3⤵
    PID:6436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34440.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        6⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63861.exe
        7⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63604.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59595.exe
        6⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11802.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58150.exe
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        6⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61871.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        5⤵
        
        PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5575.exe
        5⤵
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
        6⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44701.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12213.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
      4⤵
      PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7380.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
      4⤵
      PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
      4⤵
      PID:6876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        5⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        6⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62890.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        6⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54051.exe
      4⤵
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61548.exe
        5⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18464.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
      4⤵
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
        5⤵
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe
        5⤵
        
        PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
      4⤵
      PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22835.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54212.exe
      4⤵
      PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
      4⤵
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42274.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
      4⤵
      PID:6132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
    3⤵
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
      4⤵
      PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
      4⤵
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22835.exe
    3⤵
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
    3⤵
    PID:5460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
    3⤵
    PID:6428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-611.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-611.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25062.exe
        5⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
      4⤵
      PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
      4⤵
      PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28113.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
      4⤵
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
        5⤵
        
        PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
      4⤵
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47097.exe
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52841.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50118.exe
      4⤵
      PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe
    3⤵
    PID:3264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
    3⤵
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
    3⤵
    PID:5468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34440.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
      4⤵
      PID:296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50369.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
      4⤵
      PID:6476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
    3⤵
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
      4⤵
      PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48036.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
    3⤵
    PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16768.exe
    3⤵
    PID:6352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31662.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31662.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
    3⤵
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
      4⤵
      PID:568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
      4⤵
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5553.exe
    3⤵
    PID:4012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
    3⤵
    PID:5204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38601.exe
    3⤵
    PID:6508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
  2⤵
  PID:1600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49837.exe
    3⤵
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21726.exe
    3⤵
    PID:6076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54059.exe
    3⤵
    PID:6384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
  2⤵
  PID:3244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe
  2⤵
  PID:4604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
  2⤵
  PID:6016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
  2⤵
  PID:6492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe

Filesize
468KB

MD5
8976c76e95f5744518514c0ea6eea588

SHA1
55c7806b4d0a8fcb2113b15233b60e4b16ab7cb3

SHA256
12caf220b0d28107a7333aadf01a569beaa44c7c6bd749405f48bf6bcc8afe0a

SHA512
3f1013aa6e3b4b8d3a6faf25c2dc9d39b935a7109b56daf92a5971f2d2b097c254567c6d2a74cfb03eaa76bff06e00352c060c51eeb82ab6c773f8af8274a3b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe

Filesize
468KB

MD5
37dfbedfa8701742c0d64e21b31489ec

SHA1
95b1ea2b68b23a7ad523229e10a3a253b898136c

SHA256
ea40c4deb048ab470ce8781ae122680945de98503eda9e2dc9e5f9f405491002

SHA512
36ce2562f94040169cd0c107a80dc3f4da36edda19a29646ca1494d13bfd102c566ee45408fe42d88778d2586a0570828ed0d7b3152d8baee6e94e187460789b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51879.exe

Filesize
468KB

MD5
97de7cf2244429c4ad9a9aaf5e09b8ee

SHA1
ef02dddd97a17f534b8270fdf46a9eb95496d1b0

SHA256
e7fa65d67d070fc42828177b96cb7c7923293aadcfbfe894e9bf456e147dcab5

SHA512
06695f23d33ade0fe28f2c8c7e3724109f8c16dd8c1aee335653dd462c77d9c113e0f7f7cc56150214b67e40146b9f599d391db6d9fb3398c1d40576ba2297fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe

Filesize
468KB

MD5
35d9038aad2cd19850cc22c095fabfde

SHA1
42f7ef8f60580ea212857f586a87199f819e90b4

SHA256
38a2a33e1698db26497881fe4cd216622bed3937e83d073241ade57f9cd721ce

SHA512
78238d570adc516679686296e0b32355dfff0505fbea62eff5b49ee0ab7fb0d922f365c4b6b590e825d56067e95a3eb8a3c984f70ee282881b78c12b7c03c586

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe

Filesize
468KB

MD5
c49ea08945e6bcd2347eac1137401f15

SHA1
9908ed77aec20cb063872aff2b582582308b6f2d

SHA256
a884f88cc8dfb7d4c36cc52d3848f4a7e9ae49c5ced17107deecfaba59a16aab

SHA512
70af40e22a3b73dd01dea27da6e044a22fd4c137295f633a26c841cf7b65421d10d5c9a34b4c26bad79c66743539e7e061493c08922f68742968a72b59e3ccc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe

Filesize
468KB

MD5
19de58f2c19d424646b7762b99a9f2e0

SHA1
559952bbe1ba3078c6e19b9c141f3a6fbd2fc404

SHA256
8b08cccd536a88cc47e51669cdbd6ae90596e2fd5b4792ea9c2257afabe2178d

SHA512
93ad2479ed4ed764e3041d5c706eabf8bc4c97eb8b21f4cb585085051a8737c34620806b36595b6ca7073f526b64c557250b05da45d774aa34c7aa8c397f5ef3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe

Filesize
468KB

MD5
fe53f994cea0f63d7b7f8c1a1813b55e

SHA1
79536ebc48db19ef4e551b880388b1368f96dd32

SHA256
b98446316cf90ac5d00c47cf1fcb2152b4be68e46222467aac9af018e54b2323

SHA512
3824b073dbc3b33c299562b7287b408fb7696d1f3fb1cc92685140496512944aa429db64d34bbc90f1c159b67fbf52ac4d0daeb78357c8918aa93535a9332658

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe

Filesize
468KB

MD5
30ec923a7e7813a276f38596e90f22de

SHA1
013e0d3bfb1d23ef934aeb365ff035460d111ad0

SHA256
a100f9f2d502cfda038f826284263267f22a3dd7522b187feb4ec57af8373010

SHA512
699f9195453023429063e63e76a8e9b00e406b72e1f6fc5db6cda9ce9824684a77186fe3151bdd8c1a181a26b40deaf5eb894092fd4afdef853b9674d1f266e5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21016.exe

Filesize
468KB

MD5
3776795b1692edf4669b9934887f92cb

SHA1
6ec527f7799f8fcbcb3a179cac5949525a44c7f8

SHA256
3899976a2b11800deb627c3745f3a691b066cc2e702bd710e2b540efe6e67187

SHA512
93bcd60d6461f10aaad7e89869a92801f00b62e14928e72bf26ee85b39038a7bf648809772d21bd329c9969005e3e1bf6fbc6044288e00b9d330b5010c72a638

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe

Filesize
468KB

MD5
df59c5b71878618914324c7d15d9a8d8

SHA1
7c0a9e06255899ea2813f46e94bc7cae70a5b088

SHA256
6e6a98229ddf218c8f40495f0b50d404146352fd2bec42cffd78eb74bb9b9edd

SHA512
13716e25eb55c03c9b6c80c6ea5107cfd80c03d9a837e91cbfe44651fd40788f463f27797b726eeed6d8185521f5cb9159eb8f32ba0d8344ca1bdb9c37e0bdee

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3249.exe

Filesize
468KB

MD5
3d2a4e4276fe5480bf6cba65d2fe9ecd

SHA1
3cd42774d34d2b6366675d7d68407fba04315220

SHA256
d0bff0e821b5ee5012aa8d08b0842c87b948da0ff90c88dfff93c93458114d37

SHA512
5d491736aa517f18fec685213eb75084a1f9961809ecb5dfd0747bed296d664f2c1a142273b2658c655c87256f62b29c9fa3f3a037ba4d4f330861167b8be18c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe

Filesize
468KB

MD5
690ec8a24f6b40478d0c3ebaeb90ed7b

SHA1
8e95cb85f3e714098f7fdf4c5aca098f0934efaa

SHA256
80f0eaf927c06eb75748bf022e591f7f88b740b8d5db773d87e56ed898fd3cf7

SHA512
2bc3307eaf74f87433932ca8ab01d7055b4f6807b7d5cc6c066d62780ba2c53a567fd91788c562b2e74373561cfd943c7d0eec795d418660bc97b4916ee773d8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe

Filesize
468KB

MD5
2eacded9eb8cd782c6ee920f33c1e4b0

SHA1
64766d4b64bd68efc47d7ffbeb8a3249ca2b1786

SHA256
81a14a8d81a6ffc73e2d75fa36b095564023764456fbd8f68f59d665fbf2a6d9

SHA512
171a5f199cbb613517e619f02d652ac04c099fc9ab274719a6237c51df24c4c1f52066c787065392339663069b8b06f21ed8a23517ef641a4536168e67ac9aa5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47063.exe

Filesize
468KB

MD5
ef5f86dfc5505fdf1195a6718feba2a6

SHA1
8da49cbf3b08a10f9bba340b80fbb6c2d617d4e6

SHA256
0dc6550b17a7f9ff2b2f0d2480a7cd685127a516b93f1cf47a3ffe3f9b0bb85b

SHA512
66ee8778356e5a006d2d78bb736e7315e12340cf6649d7fabc6c61b31047c23801fde5a33381e59a7e8c7d7af939a790c2cc234e1c64974ce8187a1ff7af1217

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe

Filesize
468KB

MD5
81d9a2b658942bfe079fd51ea74faa6c

SHA1
e052634ea8e024a151bb828a7d49b7746acf4555

SHA256
d9ce20e5b0d8cba63a64cb75b7b7fab9f2d432076240bc07019ad5b364f3b46e

SHA512
3055e26164f3d09fc0cfa2c90bb31a2f53b0349f823826885a80f2997ffce023d123b8099f8ca64f12f2ba06d2f3916d9e7e502cc2a4b3c063466fd3e264e995

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe

Filesize
468KB

MD5
6df342eb2a5f35a6e7fed22ff51012c6

SHA1
8ecaca65e1355cd65a15813df9af3e293cf0b976

SHA256
1b9c87429e14b9b8661a1445f3eb5d84cb8a62a34a46fc62fd76c8248bf7f836

SHA512
43599f8c25d5dea653a66c12f2ff933a0882b1894239270f61330dc38e7cf3af182874c2b40ffad92833e30e0f3d753c5f61a794dac3d0d221ab6b36aa05da30

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49827.exe

Filesize
468KB

MD5
a8b711a1d23544f83d1b621d45d60423

SHA1
399a5242161b2631b778688f568472a15649c533

SHA256
279e600574e2d3c4551e075348c476319b6676eec9e619a6f7fabc8b685ccd09

SHA512
5d180c5b04a8c641401553284098b0a93c32b178370af5a37887adc33686b0c5ea0cbb470c9f537d6ab2512b9cbbe5406d8dab950276b563305ce6ebc86f5db7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe

Filesize
468KB

MD5
08bb0243e054f3f09d9490630322318e

SHA1
6affcc8872830a4328699806671e34ca494329c5

SHA256
5eaa32b9d235faa511dd363567483f08b463e964ba2ea0f8068bfd7f5a7b87b6

SHA512
b9b7740169944e007bfd46437985dd3471956c196a025d79ed0cfd83dec63594adbb9434e0bf2b2e37adfc983d6baf8279c25627b8b57b5401ff24a10cd5e73e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60608.exe

Filesize
468KB

MD5
17daeafbebb7632dfb1c2fc7094e7642

SHA1
f92bcb932698f0a0b3847a442b7d62a0eb9af15e

SHA256
34cd335b8adb62260d3b32c93efc9bb35383570945a9cd51569f50c70fbd8973

SHA512
7567459556f0f1e0583f6587c38e692b5048cfe216148edc5904bf15b47d32b9e1f813a94e74a376e696d47bc2479a1e39d5a822fdef921ceb105b7a32351264

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-611.exe

Filesize
468KB

MD5
cb6a6e8177a98aeed877d34197d0cb38

SHA1
95979a25a18c6cab628c598d58e2aa7522d7cdd9

SHA256
e5c3743226f05c8b28c2ae0724d04b079d492ecee223ae7cd5f8a1d8fab66977

SHA512
74f089d45346af86f45fbe7accdb05db9138022b349b3f589eca84b4869b8dbc06a8d29e36dbff7f7243b9b2dc86300b93bd0ff8976ee574e782071080ff6cd3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-876.exe

Filesize
468KB

MD5
22f749d1c936015aae090087e7ed0435

SHA1
a6e9580b3578055b7f13316a44bc4052a9d057eb

SHA256
e38ee69f38b3201c836cc552aca12a5ee4ecacd7c9bd7aafa25ce5d9dd000b8e

SHA512
4bee034a63328bf792d7135035269f399801f33e68ab2e3ad1de73f4a97bfcb623a83b15b4f4a2526ca0d0ba9fbb204f766a9a5ccfc83d05ab40f69ea901d3c8

Download Submit