829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040

Analysis

max time kernel
146s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
Size

468KB
MD5

c92964f38df986fb2958be1ad97ac462
SHA1

e322a3dd62e82cc9811cf6cef82a42689c2fafd4
SHA256

829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040
SHA512

279d718e06c7d2db69e3f2a54fd65b46e9099c3535b76bf6ff674827177d49653538c41bc064703d658be6113ee23d873a2884d9aff2880eeb02e783dc5e75fb
SSDEEP

3072:4belogxabd57tbYZPzcfmbfD/n2DnsIHQQmy2QVqAqFIkkirumulCB:4b4opb7tCP4fmbfraawqFx7rumh

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2348	Unicorn-55755.exe
2884	Unicorn-33244.exe
2992	Unicorn-60441.exe
2900	Unicorn-53747.exe
2828	Unicorn-54302.exe
2744	Unicorn-35941.exe
2760	Unicorn-42071.exe
2720	Unicorn-51391.exe
2700	Unicorn-45724.exe
1756	Unicorn-7151.exe
3024	Unicorn-23488.exe
2380	Unicorn-3622.exe
2800	Unicorn-13684.exe
1872	Unicorn-40592.exe
304	Unicorn-19879.exe
2244	Unicorn-45252.exe
2304	Unicorn-27332.exe
2512	Unicorn-1095.exe
2192	Unicorn-21516.exe
1816	Unicorn-56061.exe
584	Unicorn-22070.exe
548	Unicorn-14224.exe
1952	Unicorn-26477.exe
1480	Unicorn-63980.exe
932	Unicorn-3918.exe
2144	Unicorn-18863.exe
612	Unicorn-18976.exe
952	Unicorn-29191.exe
1716	Unicorn-43481.exe
1676	Unicorn-22969.exe
1144	Unicorn-50795.exe
1728	Unicorn-39113.exe
2108	Unicorn-56772.exe
2548	Unicorn-19269.exe
2480	Unicorn-2832.exe
2956	Unicorn-56373.exe
2888	Unicorn-30285.exe
2560	Unicorn-3664.exe
2156	Unicorn-10249.exe
2788	Unicorn-3472.exe
2740	Unicorn-38951.exe
1648	Unicorn-8132.exe
2556	Unicorn-37275.exe
976	Unicorn-57141.exe
1576	Unicorn-37598.exe
2184	Unicorn-41682.exe
2340	Unicorn-45004.exe
3060	Unicorn-53934.exe
3004	Unicorn-35936.exe
1208	Unicorn-22200.exe
1472	Unicorn-42066.exe
2096	Unicorn-42066.exe
560	Unicorn-7062.exe
296	Unicorn-26306.exe
788	Unicorn-34373.exe
2488	Unicorn-56959.exe
1200	Unicorn-6632.exe
2164	Unicorn-37358.exe
1324	Unicorn-46653.exe
956	Unicorn-57224.exe
1912	Unicorn-57224.exe
1660	Unicorn-29212.exe
1196	Unicorn-39326.exe
2188	Unicorn-39802.exe

Loads dropped DLL 64 IoCs

pid	Process
1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
2348	Unicorn-55755.exe
2348	Unicorn-55755.exe
1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
2884	Unicorn-33244.exe
2884	Unicorn-33244.exe
2348	Unicorn-55755.exe
2348	Unicorn-55755.exe
1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
2992	Unicorn-60441.exe
2992	Unicorn-60441.exe
1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
2900	Unicorn-53747.exe
2900	Unicorn-53747.exe
2884	Unicorn-33244.exe
2884	Unicorn-33244.exe
2760	Unicorn-42071.exe
2760	Unicorn-42071.exe
2992	Unicorn-60441.exe
2744	Unicorn-35941.exe
2744	Unicorn-35941.exe
2992	Unicorn-60441.exe
1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
2828	Unicorn-54302.exe
1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
2828	Unicorn-54302.exe
2348	Unicorn-55755.exe
2348	Unicorn-55755.exe
2720	Unicorn-51391.exe
2720	Unicorn-51391.exe
2900	Unicorn-53747.exe
2900	Unicorn-53747.exe
304	Unicorn-19879.exe
304	Unicorn-19879.exe
2348	Unicorn-55755.exe
3024	Unicorn-23488.exe
2348	Unicorn-55755.exe
3024	Unicorn-23488.exe
2744	Unicorn-35941.exe
1872	Unicorn-40592.exe
2744	Unicorn-35941.exe
1872	Unicorn-40592.exe
2828	Unicorn-54302.exe
1756	Unicorn-7151.exe
2828	Unicorn-54302.exe
1756	Unicorn-7151.exe
2760	Unicorn-42071.exe
2760	Unicorn-42071.exe
2700	Unicorn-45724.exe
2700	Unicorn-45724.exe
2884	Unicorn-33244.exe
2884	Unicorn-33244.exe
2380	Unicorn-3622.exe
2380	Unicorn-3622.exe
2992	Unicorn-60441.exe
2800	Unicorn-13684.exe
2992	Unicorn-60441.exe
2800	Unicorn-13684.exe
1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
2244	Unicorn-45252.exe
2244	Unicorn-45252.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3100	3928	WerFault.exe	216

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-376.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
2348	Unicorn-55755.exe
2884	Unicorn-33244.exe
2992	Unicorn-60441.exe
2900	Unicorn-53747.exe
2760	Unicorn-42071.exe
2744	Unicorn-35941.exe
2828	Unicorn-54302.exe
2720	Unicorn-51391.exe
2700	Unicorn-45724.exe
3024	Unicorn-23488.exe
1756	Unicorn-7151.exe
1872	Unicorn-40592.exe
2800	Unicorn-13684.exe
2380	Unicorn-3622.exe
304	Unicorn-19879.exe
2244	Unicorn-45252.exe
2304	Unicorn-27332.exe
2512	Unicorn-1095.exe
584	Unicorn-22070.exe
548	Unicorn-14224.exe
1952	Unicorn-26477.exe
2192	Unicorn-21516.exe
932	Unicorn-3918.exe
1480	Unicorn-63980.exe
2144	Unicorn-18863.exe
1816	Unicorn-56061.exe
952	Unicorn-29191.exe
612	Unicorn-18976.exe
1716	Unicorn-43481.exe
1676	Unicorn-22969.exe
1144	Unicorn-50795.exe
1728	Unicorn-39113.exe
2548	Unicorn-19269.exe
2108	Unicorn-56772.exe
2480	Unicorn-2832.exe
2956	Unicorn-56373.exe
2888	Unicorn-30285.exe
2560	Unicorn-3664.exe
2788	Unicorn-3472.exe
2156	Unicorn-10249.exe
2740	Unicorn-38951.exe
1648	Unicorn-8132.exe
976	Unicorn-57141.exe
2556	Unicorn-37275.exe
2184	Unicorn-41682.exe
1576	Unicorn-37598.exe
2340	Unicorn-45004.exe
3060	Unicorn-53934.exe
560	Unicorn-7062.exe
3004	Unicorn-35936.exe
1208	Unicorn-22200.exe
1472	Unicorn-42066.exe
2096	Unicorn-42066.exe
296	Unicorn-26306.exe
1660	Unicorn-29212.exe
788	Unicorn-34373.exe
1200	Unicorn-6632.exe
1196	Unicorn-39326.exe
956	Unicorn-57224.exe
2164	Unicorn-37358.exe
1324	Unicorn-46653.exe
2488	Unicorn-56959.exe
1912	Unicorn-57224.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2348	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	30
PID 1820 wrote to memory of 2348	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	30
PID 1820 wrote to memory of 2348	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	30
PID 1820 wrote to memory of 2348	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	30
PID 2348 wrote to memory of 2884	2348	Unicorn-55755.exe	31
PID 2348 wrote to memory of 2884	2348	Unicorn-55755.exe	31
PID 2348 wrote to memory of 2884	2348	Unicorn-55755.exe	31
PID 2348 wrote to memory of 2884	2348	Unicorn-55755.exe	31
PID 1820 wrote to memory of 2992	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	32
PID 1820 wrote to memory of 2992	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	32
PID 1820 wrote to memory of 2992	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	32
PID 1820 wrote to memory of 2992	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	32
PID 2884 wrote to memory of 2900	2884	Unicorn-33244.exe	33
PID 2884 wrote to memory of 2900	2884	Unicorn-33244.exe	33
PID 2884 wrote to memory of 2900	2884	Unicorn-33244.exe	33
PID 2884 wrote to memory of 2900	2884	Unicorn-33244.exe	33
PID 2348 wrote to memory of 2828	2348	Unicorn-55755.exe	34
PID 2348 wrote to memory of 2828	2348	Unicorn-55755.exe	34
PID 2348 wrote to memory of 2828	2348	Unicorn-55755.exe	34
PID 2348 wrote to memory of 2828	2348	Unicorn-55755.exe	34
PID 2992 wrote to memory of 2760	2992	Unicorn-60441.exe	36
PID 2992 wrote to memory of 2760	2992	Unicorn-60441.exe	36
PID 2992 wrote to memory of 2760	2992	Unicorn-60441.exe	36
PID 2992 wrote to memory of 2760	2992	Unicorn-60441.exe	36
PID 1820 wrote to memory of 2744	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	35
PID 1820 wrote to memory of 2744	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	35
PID 1820 wrote to memory of 2744	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	35
PID 1820 wrote to memory of 2744	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	35
PID 2900 wrote to memory of 2720	2900	Unicorn-53747.exe	37
PID 2900 wrote to memory of 2720	2900	Unicorn-53747.exe	37
PID 2900 wrote to memory of 2720	2900	Unicorn-53747.exe	37
PID 2900 wrote to memory of 2720	2900	Unicorn-53747.exe	37
PID 2884 wrote to memory of 2700	2884	Unicorn-33244.exe	38
PID 2884 wrote to memory of 2700	2884	Unicorn-33244.exe	38
PID 2884 wrote to memory of 2700	2884	Unicorn-33244.exe	38
PID 2884 wrote to memory of 2700	2884	Unicorn-33244.exe	38
PID 2760 wrote to memory of 1756	2760	Unicorn-42071.exe	39
PID 2760 wrote to memory of 1756	2760	Unicorn-42071.exe	39
PID 2760 wrote to memory of 1756	2760	Unicorn-42071.exe	39
PID 2760 wrote to memory of 1756	2760	Unicorn-42071.exe	39
PID 2744 wrote to memory of 3024	2744	Unicorn-35941.exe	41
PID 2744 wrote to memory of 3024	2744	Unicorn-35941.exe	41
PID 2744 wrote to memory of 3024	2744	Unicorn-35941.exe	41
PID 2744 wrote to memory of 3024	2744	Unicorn-35941.exe	41
PID 2992 wrote to memory of 2380	2992	Unicorn-60441.exe	40
PID 2992 wrote to memory of 2380	2992	Unicorn-60441.exe	40
PID 2992 wrote to memory of 2380	2992	Unicorn-60441.exe	40
PID 2992 wrote to memory of 2380	2992	Unicorn-60441.exe	40
PID 1820 wrote to memory of 2800	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	42
PID 1820 wrote to memory of 2800	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	42
PID 1820 wrote to memory of 2800	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	42
PID 1820 wrote to memory of 2800	1820	829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe	42
PID 2828 wrote to memory of 1872	2828	Unicorn-54302.exe	43
PID 2828 wrote to memory of 1872	2828	Unicorn-54302.exe	43
PID 2828 wrote to memory of 1872	2828	Unicorn-54302.exe	43
PID 2828 wrote to memory of 1872	2828	Unicorn-54302.exe	43
PID 2348 wrote to memory of 304	2348	Unicorn-55755.exe	44
PID 2348 wrote to memory of 304	2348	Unicorn-55755.exe	44
PID 2348 wrote to memory of 304	2348	Unicorn-55755.exe	44
PID 2348 wrote to memory of 304	2348	Unicorn-55755.exe	44
PID 2720 wrote to memory of 2244	2720	Unicorn-51391.exe	45
PID 2720 wrote to memory of 2244	2720	Unicorn-51391.exe	45
PID 2720 wrote to memory of 2244	2720	Unicorn-51391.exe	45
PID 2720 wrote to memory of 2244	2720	Unicorn-51391.exe	45

C:\Users\Admin\AppData\Local\Temp\829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe
"C:\Users\Admin\AppData\Local\Temp\829c7988c88ea551d45ce781ef65ee65cbfaf212636ce67f3ccd15443daac040.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33244.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45252.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8132.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
        9⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31426.exe
        9⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        9⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25384.exe
        9⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        8⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
        8⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        8⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        8⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        8⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
        8⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        7⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48992.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38352.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18691.exe
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56772.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        7⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        7⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
        6⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exe
        6⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8656.exe
        8⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exe
        8⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        8⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        8⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        8⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        7⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        7⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        7⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        7⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        7⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38692.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        6⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        6⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
        6⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7966.exe
        7⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31087.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
        7⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
        6⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe
        6⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20192.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3832.exe
        6⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56959.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53382.exe
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
        5⤵
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31959.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10749.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18691.exe
        5⤵
        
        PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29212.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29482.exe
        7⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
        7⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        7⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
        7⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe
        6⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        6⤵
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51448.exe
        5⤵
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7011.exe
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
        6⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe
        5⤵
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43149.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31602.exe
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12941.exe
        5⤵
        
        PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
        5⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2514.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51702.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
      4⤵
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51580.exe
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8049.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60382.exe
      4⤵
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40592.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14224.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3664.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
        7⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        7⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61666.exe
        6⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exe
        6⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16239.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40114.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64242.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59386.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43489.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56777.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        5⤵
        
        PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63980.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41682.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42335.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64291.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41550.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        5⤵
        
        PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35936.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe
        5⤵
        
        PID:3928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 180
        6⤵
        Program crash
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41550.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        5⤵
        
        PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61422.exe
      4⤵
      PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
      4⤵
      PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41017.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24385.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19879.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56373.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        6⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16030.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60679.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        5⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54453.exe
        5⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24660.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4649.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
        5⤵
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
      4⤵
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
      4⤵
      PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
      4⤵
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56061.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        5⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38692.exe
        5⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35184.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        5⤵
        
        PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36769.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
      4⤵
      PID:5508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45004.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29783.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        5⤵
        
        PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10649.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52027.exe
        5⤵
        
        PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61422.exe
      4⤵
      PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24343.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
      4⤵
      PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41917.exe
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41185.exe
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50567.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
    3⤵
    PID:5580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60441.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60441.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7151.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26477.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53934.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23015.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        7⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        6⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
        6⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22200.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51565.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
        6⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27954.exe
        5⤵
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51962.exe
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        5⤵
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53382.exe
        6⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39683.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
        5⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        5⤵
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
        5⤵
        
        PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
        5⤵
        
        PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53267.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60581.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14551.exe
      4⤵
      PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14516.exe
      4⤵
      PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10749.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
        6⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46186.exe
      4⤵
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28181.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23351.exe
      4⤵
      PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
      4⤵
      PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
      4⤵
      PID:3112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13726.exe
      4⤵
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exe
        5⤵
        
        PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17976.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
      4⤵
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
      4⤵
      PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56514.exe
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51580.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
    3⤵
    PID:5216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26306.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44344.exe
        6⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        6⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8755.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61557.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        6⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        5⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52154.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31089.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41409.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exe
        5⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27867.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12241.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8686.exe
      4⤵
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25865.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3555.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8979.exe
      4⤵
      PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51702.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
      4⤵
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        5⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        5⤵
        
        PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
      4⤵
      PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
      4⤵
      PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
      4⤵
      PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
      4⤵
      PID:592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24660.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
      4⤵
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
      4⤵
      PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6492.exe
    3⤵
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57796.exe
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
    3⤵
    PID:3832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29157.exe
    3⤵
    PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11884.exe
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
    3⤵
    PID:5240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        5⤵
        
        PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46861.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12247.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
      4⤵
      PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
      4⤵
      PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
    3⤵
    - Executes dropped EXE
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
      4⤵
      PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19403.exe
      4⤵
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43566.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-776.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
      4⤵
      PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
    3⤵
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42591.exe
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2252.exe
    3⤵
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42252.exe
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59338.exe
    3⤵
    PID:5588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
      4⤵
      PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15615.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
      4⤵
      PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
    3⤵
    PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
    3⤵
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
    3⤵
    PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
    3⤵
    PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42450.exe
    3⤵
    PID:5564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
    3⤵
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
    3⤵
    PID:5540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28399.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28399.exe
  2⤵
  PID:2396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
  2⤵
  PID:876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
  2⤵
  PID:3800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48550.exe
  2⤵
  PID:4348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
  2⤵
  PID:4220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe

Filesize
468KB

MD5
ac79b1c7e464332a47cbf4fed2d7796a

SHA1
ee368d01fe665d1b329214c5fcaf964c1a9b7ae4

SHA256
3f4bc012c136b84cb36000a5c014416c586a03664133211872528b45e6ac5563

SHA512
75cae6f187ca809544ff93eccfd8673a5aa475f4fc946d2506d4f59a667570cbfa60e2eed9af42d9c07603dfc2541a1cbf9eb5e96aced5fcfc2485a82937fc1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe

Filesize
468KB

MD5
ab1a83fb97c1f619886a1efc5685af5d

SHA1
22d9317c01ace8790d5a5bbe4a8e161a0fb507f2

SHA256
535cd1374c6c6c3642b3804e27f1234878c12ca766cf4bdd231ef90bf0ee6de2

SHA512
32f4ece72137f70f0b579536e9f4aefc3e435e0b449dda118a6e918d4de50f3d3433a5958b61494c8ae95baa1ff7c29bc42350568369845b38f90c2a0d5ba97b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe

Filesize
468KB

MD5
0f6f74756d472ecb7330c8d13bb008f5

SHA1
d0aef445d091c00ce932956faa211bfcb1de8ff4

SHA256
a83c78e2a8927055660c9159d3d0fcf10e21c0b863f1cd206e26627fa84ea923

SHA512
ee3095fc4db789abdf50f1868ee4a5175383d98c1178d86635e0dfe5e8ebb9b26edbcff3270cda6bb5caab40363881c3a5b5d84c26c0a327505817c39f74999b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe

Filesize
468KB

MD5
080bdc6bbb2254117ae24866fb505217

SHA1
2352eb7bff2faba3ca8d59122933742c854264cd

SHA256
d2bf1e04d1aa78a48dd466908560bafe28498d7bc2bc865c62f6868586025572

SHA512
cde52957843ba5e91832843bb2d459922174c136179859e8d759087a73360b57b27135446e04ce13e4c8bc094ce9c7425ab39e6419c482dc265469ba05a3dd1d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe

Filesize
468KB

MD5
0f92269a73de2ebca03ee81c4d4b43e6

SHA1
eece40b1a4fd51944abdb939aec3791cec29f698

SHA256
0c9f1d70f856512e20c986a5eb4a337ab5291b34d7ce2f00f9e6885a85fcb71b

SHA512
ae01043a1442c0f25175ab75d2fefa82599f46948a400168e353147046f3ee9f58c4337e9406275ca943dafd35edacb36a2335b56989927d6447b05844090d89

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19879.exe

Filesize
468KB

MD5
8727e207cb332659c88993f2ed4d0af7

SHA1
5784db2f7eebc2aa2da1c79986586e376ca92a1e

SHA256
46f5eb5bffdb7b463e62eca62663ffee2fe03728a5dd7189499d4ef426c17f1b

SHA512
11caf1bae3e08020296fe3d2ff593b8203ff602df2c3955af1f58d0dc3b3fd5cf8d49df8c1000f1159c95325d1edb6be1d56ef967565d7196944c05d35f55d10

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe

Filesize
468KB

MD5
9e02f9dda43e4de03f6aba307a271aa8

SHA1
559f9c01bb80910afaa0fde3aa124ed96fbef4b8

SHA256
a8fdf5ad37659d7524f5fad2f386de034cf1fe095d6c14dfd7c371c5025905d0

SHA512
126deb635444396906e59d5b2de84be7dc23951b5abc757e5944828889849e1752fd6bdaa90e6e906f958780b93ee3a8110a0bec3521e57a3f5b865c156db9d1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33244.exe

Filesize
468KB

MD5
d3090e51637bc221c3de1410a4bfc48c

SHA1
6d662f9b8a833f6330998dd2f2afd79ba137155a

SHA256
d755ae3ea91e3b55092b6583be649a5eb6825cd0f11d0e4365a9f2b293aaf26a

SHA512
5c877d0ea847545ff814e37809f70fdaed7e78f5b6ef55daffb0338d46999df302247d65d1fa5425d809bb28f67f0cc9895561dae22d51c88e837dccbe596007

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe

Filesize
468KB

MD5
7738d18b02dd64dba05ab8aac241a9e5

SHA1
4d6289ccaf390c842f0cf121660afae028c6f285

SHA256
eb27c40e2caf0ef56520d0facf2869b5720a87ad1f66410dffd7161a4fc676da

SHA512
777aae71af032a82e534ee1ec94d5c2a2cb344d22daf15a2ca66381e06d66f2ecd84a7005905658a2199e527e8903461cac73b81f15382c1a444d2e8b32d5b72

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40592.exe

Filesize
468KB

MD5
69053a67b76ef045876d9a5569e8a41f

SHA1
9afc94a6870abde9d3e57edd4b65111d98a7ce23

SHA256
e845ef4ca69db16f85f5fff36b05d64fe3472e55b9d3561c56bef3aeaf8aa63f

SHA512
87eccb2757258b4fb3c0002e6cc6f4c47424e11e963078f8927ef5a1d5edacc915325b0ec05f4e11d85422f8e11618b0c4c2f184b62a20e5f3f8cc758eeb543f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe

Filesize
468KB

MD5
c3e3ac37a6662fcd825022a8183e81f0

SHA1
d640491b5c5f5f0dc1b229bc57959fb48f69860c

SHA256
d23159659ed6ec5cb2612b302a7e87786eb055bbc2fcc37437736b6364cecf51

SHA512
44d3025ca10dd1de911ce7b5975af19f97b15d5312abd8968439613aa9731061c8fb1dc4c2e17a756401c4a4d2bee8c67daa49e0976554837a5d3b67b14d0823

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45252.exe

Filesize
468KB

MD5
768d884eb2e2d460f2c7a1c3ec482840

SHA1
27208593308612f87de9605a670cb41e11c27c97

SHA256
83a2b307164bf700d563352ed4e10fe6db1d386faef3794c0d133fd6998d435f

SHA512
48465b4e558610ef474cbb4135077438fab4870d93b66ddf188cf263045ba2b4bff3d6c11489372e473e09c5bed8daa3de0c724fad1a504a481cd32f49acf136

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe

Filesize
468KB

MD5
0fe83730ada850f5036ab1fbdc19e029

SHA1
08ad09b09893a65ccf28dfb426bc4d9b3b33b7c1

SHA256
461e2efbe56472fe1d30b4856a0c28ceb72dd39708819ac74e073a5d463180d6

SHA512
bb42d84caea04be52bfc47e02d0aaa0aba94dae1c1482710d188ccf59417e95a380e7ec5bf4cd4c93cdfdacb376b7e3859fdd57f1cd88db16c78226bc1b0fadf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe

Filesize
468KB

MD5
066723e15848d694046b622c80b4a959

SHA1
b95bbad67de9b6c0a1d2b262c31bf5a0f621ad5d

SHA256
1540767097134126083939e1e9e31523f159a1009630a55656be1e66605fc6d6

SHA512
17c97680c92fc8b242c6ddcc6bbc0dbc723d129e46d5419a0972fbeed9490fbf828cea2a99b83d17750d122ac402657aad0fc3ffc8c7139f5d1f329826dadc9b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe

Filesize
468KB

MD5
efe63c990ae5e985fb4d96b9d3070a1a

SHA1
10364e5ac369dee04da4fad9e3bcdebfead7b8c7

SHA256
a59e94fba9eb3eac228c6992e650cc1df3da94b9f19effdd799dd40729f26ace

SHA512
ef0d84d5c922b0a421fa94b4ec98b5e4d2ba98d51f8da9920ed90d843a4310cb661bb6de04f7f3a55ff25929f30d0ad6e0a68346ed52096ab39c1d5c5da12197

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe

Filesize
468KB

MD5
4f7d8decd7eae12d3450fa0eb53578cf

SHA1
cf32b5db268fd5d607e0b24093e418c8573a86f6

SHA256
97305a3bda2972f5bdd7edb00cac60e712ae2b97421875db14e4b25e70d72a7f

SHA512
47898415753196c7a1ae550c6bab22d59024926db0ffefd5ba6a90ce91efdb838955b3abfc0bfc59e51001ead6d51007888a1a6c99273e58faeef0407b162d0d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60441.exe

Filesize
468KB

MD5
3296908392dfbad1e80c38747ee4e0ec

SHA1
ab0087b72c807d92604e13de69cfd1db4f12426a

SHA256
8bf8e43327a3b53e48fc892c1144ee9d7522c6735d76556eb97d3532a137b7d1

SHA512
24faefdce0fcb8e6b82f60022bb7647f3c2c18b384b74db34982a33bc222dd42246d20238acc61f70f633adb0623e1769d5659adf8f29cb8fda7f3a5d21fed36

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7151.exe

Filesize
468KB

MD5
d5957aa5c3a8b3f760acf0b721a10024

SHA1
3520ff759f6a866e73981ce3e5ebe8eb563f8a2d

SHA256
1c9591ed55f54986b910bf576de6653c170f84345c9321d699ff08085a475aad

SHA512
887bdaa87b51f8419e7d9fa1193a43ca6b99c0fe6cd4d51dd6a4f0848461e4aefdc04973f211ef7bbfca75feaff6e50792cc8a6d8f29fc6c88e3ac62432450aa

Download Submit