f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
Size

468KB
MD5

20c465b87ad82645d326846eee4f8aaf
SHA1

819c637306925ff8e92ce649fd92ad5961cc3f6a
SHA256

f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221
SHA512

d8bf03b9422f3b6b7fbaec4978aa74cc9fb8acad70d40bf53ed879db6dd41c38ce0ae2494e1eeb52921eb0d0971fc85548a05bb88dff5c614036c4ebe90d182e
SSDEEP

3072:gJZzo3ldIq3YtbYfPzejNfT/rfh7TIpqD3HCNV548uLLRU1FqalV:gJ5oMcYt4PqjNfx0DW8uPq1Fq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2380	Unicorn-34398.exe
2700	Unicorn-41675.exe
2720	Unicorn-53373.exe
2920	Unicorn-14774.exe
1296	Unicorn-23135.exe
3056	Unicorn-45179.exe
2620	Unicorn-58914.exe
1848	Unicorn-4629.exe
1276	Unicorn-61806.exe
1492	Unicorn-4629.exe
1716	Unicorn-39148.exe
2360	Unicorn-25412.exe
1968	Unicorn-4172.exe
1536	Unicorn-61614.exe
1728	Unicorn-18146.exe
792	Unicorn-57717.exe
2104	Unicorn-57717.exe
2384	Unicorn-44676.exe
2120	Unicorn-17954.exe
2152	Unicorn-40421.exe
2996	Unicorn-20363.exe
2192	Unicorn-40229.exe
1888	Unicorn-16031.exe
1464	Unicorn-63508.exe
2036	Unicorn-17837.exe
2952	Unicorn-26005.exe
3008	Unicorn-47172.exe
1736	Unicorn-51121.exe
1564	Unicorn-39191.exe
2052	Unicorn-6637.exe
1460	Unicorn-56020.exe
1020	Unicorn-11458.exe
2348	Unicorn-39492.exe
1768	Unicorn-61043.exe
2320	Unicorn-48236.exe
2136	Unicorn-11842.exe
2792	Unicorn-48074.exe
2840	Unicorn-46228.exe
2828	Unicorn-57883.exe
2396	Unicorn-12211.exe
3052	Unicorn-12211.exe
2008	Unicorn-6657.exe
2608	Unicorn-12787.exe
2540	Unicorn-59336.exe
2340	Unicorn-34342.exe
2412	Unicorn-31542.exe
2408	Unicorn-40473.exe
2240	Unicorn-23559.exe
2644	Unicorn-49025.exe
1060	Unicorn-42895.exe
1808	Unicorn-29159.exe
1440	Unicorn-6575.exe
2068	Unicorn-59798.exe
1872	Unicorn-56077.exe
984	Unicorn-25782.exe
2372	Unicorn-25403.exe
2040	Unicorn-50478.exe
2116	Unicorn-57421.exe
2992	Unicorn-54628.exe
960	Unicorn-60758.exe
540	Unicorn-60758.exe
628	Unicorn-39553.exe
2204	Unicorn-33025.exe
860	Unicorn-33025.exe

Loads dropped DLL 64 IoCs

pid	Process
2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
2380	Unicorn-34398.exe
2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
2380	Unicorn-34398.exe
2700	Unicorn-41675.exe
2720	Unicorn-53373.exe
2700	Unicorn-41675.exe
2720	Unicorn-53373.exe
2380	Unicorn-34398.exe
2380	Unicorn-34398.exe
2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
3056	Unicorn-45179.exe
1296	Unicorn-23135.exe
2920	Unicorn-14774.exe
1296	Unicorn-23135.exe
3056	Unicorn-45179.exe
2920	Unicorn-14774.exe
2380	Unicorn-34398.exe
2380	Unicorn-34398.exe
2700	Unicorn-41675.exe
2700	Unicorn-41675.exe
2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
2620	Unicorn-58914.exe
2620	Unicorn-58914.exe
2720	Unicorn-53373.exe
2720	Unicorn-53373.exe
1276	Unicorn-61806.exe
1276	Unicorn-61806.exe
2360	Unicorn-25412.exe
2360	Unicorn-25412.exe
1296	Unicorn-23135.exe
1296	Unicorn-23135.exe
2700	Unicorn-41675.exe
2700	Unicorn-41675.exe
1848	Unicorn-4629.exe
1848	Unicorn-4629.exe
2920	Unicorn-14774.exe
2920	Unicorn-14774.exe
1968	Unicorn-4172.exe
1968	Unicorn-4172.exe
2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
3056	Unicorn-45179.exe
3056	Unicorn-45179.exe
1536	Unicorn-61614.exe
1536	Unicorn-61614.exe
1716	Unicorn-39148.exe
1716	Unicorn-39148.exe
2620	Unicorn-58914.exe
2620	Unicorn-58914.exe
2380	Unicorn-34398.exe
2380	Unicorn-34398.exe
1728	Unicorn-18146.exe
1728	Unicorn-18146.exe
2720	Unicorn-53373.exe
2720	Unicorn-53373.exe
792	Unicorn-57717.exe
792	Unicorn-57717.exe
1276	Unicorn-61806.exe
1276	Unicorn-61806.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3156	2576	WerFault.exe	109

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32281.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
2380	Unicorn-34398.exe
2700	Unicorn-41675.exe
2720	Unicorn-53373.exe
1296	Unicorn-23135.exe
2920	Unicorn-14774.exe
3056	Unicorn-45179.exe
2620	Unicorn-58914.exe
1276	Unicorn-61806.exe
1492	Unicorn-4629.exe
1848	Unicorn-4629.exe
2360	Unicorn-25412.exe
1716	Unicorn-39148.exe
1536	Unicorn-61614.exe
1968	Unicorn-4172.exe
1728	Unicorn-18146.exe
792	Unicorn-57717.exe
2104	Unicorn-57717.exe
2384	Unicorn-44676.exe
2192	Unicorn-40229.exe
2152	Unicorn-40421.exe
1888	Unicorn-16031.exe
2996	Unicorn-20363.exe
1464	Unicorn-63508.exe
2120	Unicorn-17954.exe
2952	Unicorn-26005.exe
2036	Unicorn-17837.exe
3008	Unicorn-47172.exe
1736	Unicorn-51121.exe
1564	Unicorn-39191.exe
2052	Unicorn-6637.exe
1020	Unicorn-11458.exe
1460	Unicorn-56020.exe
2348	Unicorn-39492.exe
1768	Unicorn-61043.exe
2320	Unicorn-48236.exe
2136	Unicorn-11842.exe
2792	Unicorn-48074.exe
2840	Unicorn-46228.exe
3052	Unicorn-12211.exe
2828	Unicorn-57883.exe
2396	Unicorn-12211.exe
2008	Unicorn-6657.exe
2608	Unicorn-12787.exe
2540	Unicorn-59336.exe
2412	Unicorn-31542.exe
2340	Unicorn-34342.exe
2408	Unicorn-40473.exe
2240	Unicorn-23559.exe
1808	Unicorn-29159.exe
2644	Unicorn-49025.exe
1060	Unicorn-42895.exe
1440	Unicorn-6575.exe
2068	Unicorn-59798.exe
1872	Unicorn-56077.exe
984	Unicorn-25782.exe
2372	Unicorn-25403.exe
2040	Unicorn-50478.exe
2116	Unicorn-57421.exe
960	Unicorn-60758.exe
540	Unicorn-60758.exe
2992	Unicorn-54628.exe
628	Unicorn-39553.exe
860	Unicorn-33025.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2380	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	30
PID 2168 wrote to memory of 2380	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	30
PID 2168 wrote to memory of 2380	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	30
PID 2168 wrote to memory of 2380	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	30
PID 2168 wrote to memory of 2700	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	32
PID 2168 wrote to memory of 2700	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	32
PID 2168 wrote to memory of 2700	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	32
PID 2168 wrote to memory of 2700	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	32
PID 2380 wrote to memory of 2720	2380	Unicorn-34398.exe	31
PID 2380 wrote to memory of 2720	2380	Unicorn-34398.exe	31
PID 2380 wrote to memory of 2720	2380	Unicorn-34398.exe	31
PID 2380 wrote to memory of 2720	2380	Unicorn-34398.exe	31
PID 2700 wrote to memory of 2920	2700	Unicorn-41675.exe	33
PID 2700 wrote to memory of 2920	2700	Unicorn-41675.exe	33
PID 2700 wrote to memory of 2920	2700	Unicorn-41675.exe	33
PID 2700 wrote to memory of 2920	2700	Unicorn-41675.exe	33
PID 2720 wrote to memory of 1296	2720	Unicorn-53373.exe	34
PID 2720 wrote to memory of 1296	2720	Unicorn-53373.exe	34
PID 2720 wrote to memory of 1296	2720	Unicorn-53373.exe	34
PID 2720 wrote to memory of 1296	2720	Unicorn-53373.exe	34
PID 2380 wrote to memory of 3056	2380	Unicorn-34398.exe	35
PID 2380 wrote to memory of 3056	2380	Unicorn-34398.exe	35
PID 2380 wrote to memory of 3056	2380	Unicorn-34398.exe	35
PID 2380 wrote to memory of 3056	2380	Unicorn-34398.exe	35
PID 2168 wrote to memory of 2620	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	36
PID 2168 wrote to memory of 2620	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	36
PID 2168 wrote to memory of 2620	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	36
PID 2168 wrote to memory of 2620	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	36
PID 1296 wrote to memory of 1276	1296	Unicorn-23135.exe	37
PID 1296 wrote to memory of 1276	1296	Unicorn-23135.exe	37
PID 1296 wrote to memory of 1276	1296	Unicorn-23135.exe	37
PID 1296 wrote to memory of 1276	1296	Unicorn-23135.exe	37
PID 3056 wrote to memory of 1492	3056	Unicorn-45179.exe	38
PID 3056 wrote to memory of 1492	3056	Unicorn-45179.exe	38
PID 3056 wrote to memory of 1492	3056	Unicorn-45179.exe	38
PID 3056 wrote to memory of 1492	3056	Unicorn-45179.exe	38
PID 2920 wrote to memory of 1848	2920	Unicorn-14774.exe	39
PID 2920 wrote to memory of 1848	2920	Unicorn-14774.exe	39
PID 2920 wrote to memory of 1848	2920	Unicorn-14774.exe	39
PID 2920 wrote to memory of 1848	2920	Unicorn-14774.exe	39
PID 2380 wrote to memory of 1716	2380	Unicorn-34398.exe	40
PID 2380 wrote to memory of 1716	2380	Unicorn-34398.exe	40
PID 2380 wrote to memory of 1716	2380	Unicorn-34398.exe	40
PID 2380 wrote to memory of 1716	2380	Unicorn-34398.exe	40
PID 2700 wrote to memory of 2360	2700	Unicorn-41675.exe	41
PID 2700 wrote to memory of 2360	2700	Unicorn-41675.exe	41
PID 2700 wrote to memory of 2360	2700	Unicorn-41675.exe	41
PID 2700 wrote to memory of 2360	2700	Unicorn-41675.exe	41
PID 2168 wrote to memory of 1968	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	42
PID 2168 wrote to memory of 1968	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	42
PID 2168 wrote to memory of 1968	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	42
PID 2168 wrote to memory of 1968	2168	f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe	42
PID 2620 wrote to memory of 1536	2620	Unicorn-58914.exe	43
PID 2620 wrote to memory of 1536	2620	Unicorn-58914.exe	43
PID 2620 wrote to memory of 1536	2620	Unicorn-58914.exe	43
PID 2620 wrote to memory of 1536	2620	Unicorn-58914.exe	43
PID 2720 wrote to memory of 1728	2720	Unicorn-53373.exe	44
PID 2720 wrote to memory of 1728	2720	Unicorn-53373.exe	44
PID 2720 wrote to memory of 1728	2720	Unicorn-53373.exe	44
PID 2720 wrote to memory of 1728	2720	Unicorn-53373.exe	44
PID 1276 wrote to memory of 792	1276	Unicorn-61806.exe	45
PID 1276 wrote to memory of 792	1276	Unicorn-61806.exe	45
PID 1276 wrote to memory of 792	1276	Unicorn-61806.exe	45
PID 1276 wrote to memory of 792	1276	Unicorn-61806.exe	45

C:\Users\Admin\AppData\Local\Temp\f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe
"C:\Users\Admin\AppData\Local\Temp\f5c8d4db9a1afa8e1e0f7922590385c61b264a1aac6e1e9208b63bcc96c61221.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53373.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41893.exe
        9⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        9⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        9⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
        9⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        9⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        9⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38555.exe
        8⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        8⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        8⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39811.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13055.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        8⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18215.exe
        8⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
        9⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58067.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe
        8⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        8⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49642.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        8⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
        7⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45743.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        8⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        8⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exe
        7⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        7⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17971.exe
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        8⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23120.exe
        8⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
        7⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58110.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        7⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        7⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54628.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8269.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        7⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
        6⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53767.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        6⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22987.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44676.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
        7⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        8⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
        8⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        8⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-542.exe
        8⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        8⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        8⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3161.exe
        7⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59356.exe
        7⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31702.exe
        6⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39550.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56037.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        7⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
        6⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        6⤵
        
        PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48074.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        6⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        7⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36858.exe
        6⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25438.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        6⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        6⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20337.exe
        5⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        6⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32231.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3755.exe
        5⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        5⤵
        
        PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39191.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62691.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
        7⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        6⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27174.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        6⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        6⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31086.exe
        6⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57911.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        5⤵
        
        PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        5⤵
        
        PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        6⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35245.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38555.exe
        5⤵
        
        PID:272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6112.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        5⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        5⤵
        
        PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        5⤵
        
        PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35245.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32955.exe
      4⤵
      PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
      4⤵
      PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18851.exe
      4⤵
      PID:6176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45179.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        6⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10971.exe
        7⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23120.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27481.exe
        7⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        7⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8246.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14886.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        7⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56643.exe
        6⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46098.exe
        7⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25070.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        5⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25601.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36413.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        5⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51743.exe
        5⤵
        
        PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63508.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34342.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60512.exe
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        6⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30646.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-542.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        5⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        5⤵
        
        PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19966.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
        5⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
      4⤵
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        5⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        5⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
      4⤵
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
      4⤵
      PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      4⤵
      PID:7184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39148.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26005.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        5⤵
        Executes dropped EXE
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10357.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        6⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:7604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50594.exe
        5⤵
        
        PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39811.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13055.exe
        5⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        5⤵
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22064.exe
      4⤵
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        5⤵
        
        PID:608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        5⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        5⤵
        
        PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
      4⤵
      PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57944.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exe
      4⤵
      PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
      4⤵
      PID:7712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51121.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10971.exe
        5⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2774.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13523.exe
        6⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
        5⤵
        
        PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13522.exe
        5⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        5⤵
        
        PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
      4⤵
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe
        5⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7658.exe
        5⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49707.exe
      4⤵
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe
      4⤵
      PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
      4⤵
      PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
      4⤵
      PID:7360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31542.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
      4⤵
      PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13439.exe
      4⤵
      PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
      4⤵
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
      4⤵
      PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
      4⤵
      PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
      4⤵
      PID:7588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41315.exe
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23063.exe
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
    3⤵
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26976.exe
    3⤵
    PID:5864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
    3⤵
    PID:7092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
    3⤵
    PID:7632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41675.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41675.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14774.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40421.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        8⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39550.exe
        8⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34055.exe
        8⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
        7⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        7⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-542.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14886.exe
        7⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        7⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        6⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43400.exe
        6⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52718.exe
        7⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        7⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-542.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39382.exe
        5⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3630.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60179.exe
        6⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exe
        5⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
        5⤵
        
        PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20363.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55906.exe
        5⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4863.exe
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
        5⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48395.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exe
        5⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        5⤵
        
        PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34939.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        6⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        5⤵
        
        PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        5⤵
        
        PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
      4⤵
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60876.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        5⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        5⤵
        
        PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48925.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
      4⤵
      PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
      4⤵
      PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      4⤵
      PID:7176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39492.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        7⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        7⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21188.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59140.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        6⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-247.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49642.exe
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe
        5⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        5⤵
        
        PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44559.exe
        6⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        6⤵
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49396.exe
        5⤵
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
        5⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22745.exe
        5⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        5⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        5⤵
        
        PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39553.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
        5⤵
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        5⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        5⤵
        
        PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56459.exe
      4⤵
      PID:908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8110.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28451.exe
      4⤵
      PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe
      4⤵
      PID:7156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17954.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11798.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        6⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        6⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38010.exe
        5⤵
        
        PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
        5⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        5⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        5⤵
        
        PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
      4⤵
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56016.exe
        5⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9958.exe
        5⤵
        
        PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
      4⤵
      PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53767.exe
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
      4⤵
      PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      4⤵
      PID:7536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6575.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
      4⤵
      PID:280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44588.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57407.exe
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24824.exe
      4⤵
      PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      4⤵
      PID:6180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
    3⤵
    PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
      4⤵
      PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
      4⤵
      PID:7328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
    3⤵
    PID:3968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
    3⤵
    PID:4864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
    3⤵
    PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
    3⤵
    PID:6804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51743.exe
    3⤵
    PID:7528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55906.exe
        5⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        6⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        5⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        5⤵
        
        PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56643.exe
        5⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        6⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25070.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14245.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe
        5⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17971.exe
        5⤵
        
        PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
      4⤵
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41893.exe
        5⤵
        
        PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38820.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
        5⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        5⤵
        
        PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17699.exe
      4⤵
      PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8110.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12115.exe
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe
      4⤵
      PID:7108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45896.exe
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        6⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52245.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        6⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58110.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31700.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exe
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        5⤵
        
        PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe
      4⤵
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        5⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        5⤵
        
        PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
      4⤵
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49238.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14245.exe
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22110.exe
      4⤵
      PID:7688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6657.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe
      4⤵
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        5⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18702.exe
        5⤵
        
        PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
      4⤵
      PID:652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
      4⤵
      PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
      4⤵
      PID:6396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
    3⤵
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
      4⤵
      PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30052.exe
      4⤵
      PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8535.exe
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
    3⤵
    PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exe
    3⤵
    PID:6636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
    3⤵
    PID:7704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46228.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        5⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36402.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        5⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
      4⤵
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
        5⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
        5⤵
        
        PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27241.exe
      4⤵
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35827.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42228.exe
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
      4⤵
      PID:6184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57883.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
      4⤵
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        5⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19966.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51912.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
        6⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        6⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        5⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8902.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        5⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        5⤵
        
        PID:7368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
      4⤵
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
        5⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
        5⤵
        
        PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
      4⤵
      PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
      4⤵
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
      4⤵
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
    3⤵
    PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
      4⤵
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11205.exe
        5⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
      4⤵
      PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
      4⤵
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
      4⤵
      PID:7580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
    3⤵
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
      4⤵
      PID:6892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
    3⤵
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
    3⤵
    PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
    3⤵
    PID:5832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11399.exe
    3⤵
    PID:6952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
    3⤵
    PID:6756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16031.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16031.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40473.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
      4⤵
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
      4⤵
      PID:588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
      4⤵
      PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
      4⤵
      PID:7564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
    3⤵
    PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
      4⤵
      PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
      4⤵
      PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17156.exe
      4⤵
      PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
      4⤵
      PID:7472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8405.exe
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52112.exe
    3⤵
    PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
    3⤵
    PID:6476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
    3⤵
    PID:7484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28984.exe
    3⤵
    PID:2576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 240
      4⤵
      Program crash
      PID:3156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5171.exe
    3⤵
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
    3⤵
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45089.exe
    3⤵
    PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
    3⤵
    PID:7384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
  2⤵
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
    3⤵
    PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28864.exe
    3⤵
    PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7658.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3441.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3441.exe
  2⤵
  PID:2508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
  2⤵
  PID:3800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
  2⤵
  PID:4728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
  2⤵
  PID:5212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
  2⤵
  PID:5948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34252.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34252.exe
  2⤵
  PID:6212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe

Filesize
468KB

MD5
62b75c4ea777cf2c9c42752f8835d5ee

SHA1
5d9454219869634d70bd7c428ae4fcc52851ba82

SHA256
cecfa1278071815d7d8c32e6e9f08a86f38d4050a912b04243b9624b93273e0e

SHA512
01504f661eca2651e7901027e7babc017001d3cb541ffc7c168aad13692be050197e34c5cd13fcfbb81f6d99ff7379517f088238b0f78bc6e3eebf93db013ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe

Filesize
468KB

MD5
8dd40210e2b301ab99245d15cd74aa3b

SHA1
9dca1cc446771a9dd764b40594ac888c4127f42e

SHA256
85a206d2c9522dee961c096f0c3eca66172a74d0b81bf56a44595235d9a29600

SHA512
6f5bd8553a1afaf98dc3ed0ea2441a88af6168756bbc3514296323b9ce55995885e27aeb7cf568cb79ea7e02dbfa59b30dbc18782716c7a5a96e55fad1f84695

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe

Filesize
468KB

MD5
d633753cfbeacc57b9faf4ee34fdd31e

SHA1
e648e661f7e1554c6674ef3edd4eaea456392fe5

SHA256
ef7d0456fe7cd488f3586bfa4b6554e40b574730432a6ded4a013f242f40de87

SHA512
05b0c7e2aecc105b2ba55c23f717c5c97f912cd07df903a77ba45897479487a2e5d568811018903bf16c017fc9acf7f0b3d12a4d991cf2c4dd8e55236c1ed5e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39148.exe

Filesize
468KB

MD5
3946c0a04cf13b6a1145ae4b3ee2d0ba

SHA1
7686463201247b3ad408f03fe85a842557b5f5d2

SHA256
efd0f097c32a646910b3c6d93514ff53b1602bca901885615d339a4a4ba78fb6

SHA512
ee6e280f6a4faada23b7d402bffbeec455d1d68267731a7f27c2d9456021c82af593927f2e90b369a02badf7c16f33ac14e8d8a45e9e4a086e1834bc0871bba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe

Filesize
468KB

MD5
c088177888549a330ce8aed6506a6146

SHA1
4e075d563fc7ecc2c01b808eb6fc6e5c2c244a0e

SHA256
1c2253f9bf00929757c5c745a5d077b30e0d83dfda267fdd01b149cdcfde536f

SHA512
a86fb7b07f2f8b733d5a743b42539f2d4eeff24d95aad327f0ce85ad21cbd933cfdab519c44e72ce5743652f67de71fc0354802ee56176eef559922c5a0329ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42228.exe

Filesize
468KB

MD5
c9bbf21f5115e6e8950110e925e64d61

SHA1
24f127e50162193437750d78d77520b0b592d832

SHA256
772058061401c7d0f9e9a00ac9bb1b00272bc8b2fce06d4274520f4b4cbb27bb

SHA512
e17189c5cb75306993150bffd482b4054818edf405f6058eebe2d0de8b3a2b04fb29a65ea120dbc7b39d6e2a8c2d54a272affd1bbc6b1d8315c7dbabf3c30c10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45179.exe

Filesize
468KB

MD5
71b02804c02c3a94623bee6153581801

SHA1
157f64a4e3302317e9e844f73727a3d40a36e5ac

SHA256
4f5820ed3925d1b72d38ea1ae7e71e0998b16067f5b971ba6d62e317bd27125d

SHA512
2849a3a75d635f156b6f61defdd4416c4b73a17a4357c2979e40f31c6c5da3f8126a9964484d84b2d6633b18bf38e280f180527123941f744913d538ad0d2d5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe

Filesize
468KB

MD5
29651794add37748adf07044addfb623

SHA1
99ce69a16d1203367c2a4e4bc671d818b2d17d3f

SHA256
fadac286e080bdf2c120a394f6b63eba36cdb873bab62a8c3239beb63b144e03

SHA512
96fa90ca52b6411057ef8fc445c9dc03d539a92810c8a1acd79c9fcddb8b36bfcb30e61f2b36ec7b535e9294378dd810950e7d28eb755914fc4f6ca1da62ac79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe

Filesize
468KB

MD5
a4640ca542fe07b442f61ab53296d41d

SHA1
f47091e357a8af60a188a46c9e4f9a56e8dab0dc

SHA256
fea5fefed6574a28db5d1cacf2837d79e53d9a46962aba1d456a626bf0c9aa5f

SHA512
6d5500533a1d0d1db18a7112a751a1fb0f00f3d068c183bbc93c52899f64f146860f0a9a2c40cea4fcd8a55047342469c428815b0c277d75fd758e6d2842bb26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe

Filesize
468KB

MD5
5cda6f95b66ac83d0ab824b7a08dbc3b

SHA1
3ddfd133fb0e4c2940c9c7c95a3dbf3bd7b61254

SHA256
aa451f9677df9531df09b4b74497d946c9a43caa0f69ddb6bcec3fae787654f5

SHA512
b6808f515852ffae7b2d69eaaf44140ab327f0f8df4854a1a72ba90a36128dd1e76a215a85c7b722e1128b893f2309ff48febb82f1781425027ffa2da8ae4d39

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14774.exe

Filesize
468KB

MD5
13d4a52771a8f5496bb1d6bb52963731

SHA1
8496de31749086a3b1d0baf86656ccc44229bcb3

SHA256
a82f6b44d7e0c0ded598b42b9dce9f0d31f582bcf69704edf1a7d5c15f8b3b96

SHA512
bbc282775b6764834e9d37cc77da582ee62b86912bf28427f8a8cb5113802feb86f318f5f59141e28a367ae5a499d42b2356cb526b0e91b49a8f158cf423dd68

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe

Filesize
468KB

MD5
a7083b850fd0bfe30d209e30e21c681c

SHA1
fe7f62669b4c6fda75f2dffba181a9812c63754f

SHA256
3a0b8bf1a573e6120e38b89856b3676a6b5516ceaa2b9e3766ef0cc4315cd870

SHA512
3c03bc32196c29fd5ecc572dc85bc93b7c8d50813c144105ae69deaec5dfe34364516b4a2491f3237c05bf3ba389b391dd9426c9e0e8ed408e56621baf79899b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe

Filesize
468KB

MD5
fc57d9e7ba19d716b6e24717f573c51e

SHA1
b7f34a22be3a1701a5e062967ce2a93835780c2a

SHA256
49f9bbc801f51d6affe943f5af7c535eda86b40ab73789abf1a8848764465471

SHA512
8eace23e5b6a0a8cb6a3bc0f84e6327c7043492a9066c705317ed4124549b30ac73aaa42b803bc7e2a8846be7d74154eb252deab781bfb07cb15c368ea0cacaa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41675.exe

Filesize
468KB

MD5
ade80f987c35968b82d7a7c66bf2e610

SHA1
439a9d48d418a188ac481ff53d88e99a5fcd57c7

SHA256
6eab0550062c7e14ff0de4571e7ea14bd5ff8c3f3878c6497fede4d90fb39c49

SHA512
0e050c40253c3f4982296d6377ca1aded8247499e26703e7ca106c3c7c334a06a642324335844d81051db9a3e93f4f1204e50776bac5e271c7280f3c54ce8847

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44676.exe

Filesize
468KB

MD5
270ee022e9c6c7cd4e4c6375ea4880a3

SHA1
7073b5775da61220b2e61fb53d50439d2d76af34

SHA256
847e47796e9b13e72bc3c5d86ebd556217448affb8722d2fea253e0e02164990

SHA512
fa47b094e090b87b084c4fed967820c82c985eb733a6c32f12c01676fe7e13ffa6a24c9ca2d766b4d4bf30f3717e92673ca3780d5b9156bbc7f16324059448ba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe

Filesize
468KB

MD5
e195d85c10b35cbce745014418179d35

SHA1
bca756ee8696598ab47733b960238ee9e422af3c

SHA256
793b73b49fc8bf70c599ed8949a0b87712639c10c15a073f5357e7523ced8fa4

SHA512
f7deeedaeb1514c11708dc2b307119d82426dd4b7eee8c2e1ed5b7ff48cbf3302fd5ada19d279b21a3656b5c9ff59c9210f26dbd7da1977dc9fab68fb4f0c834

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53373.exe

Filesize
468KB

MD5
4ade83a8e48cfc2c5a4df89d0d3bdcaa

SHA1
9550d63dc259fa36124fbfa7bc39b68456293edc

SHA256
f7b2b02a65d5ca6b80737d7c866dc7291dc833df19643330c16efb3348b39a96

SHA512
df1ad6dd142dfbbc59cf8828ea4d53026964d7d8454958a7d2a23647e0939e9bd4ecf53c48b5bd5ec95ebc0556c849c7105200aa9afacc7efd24cac93388475a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe

Filesize
468KB

MD5
2ec70884b177274d40a5eeb6e313f5b0

SHA1
ab9f71e22c1ccbb23dc8f2a28323e48e32248ddf

SHA256
b8e2a839d1fa4d8d9afdb39b9980abf12bf4c5cc1294f841123ba7c08e5c02eb

SHA512
52b9f3295a0064cf3b8f160aaa42625522ba28e71c28aff0ba54537021ccecc82fa01d794dbe7122170c30114647eb5f08dcd6f711e789f69412a207be407a95

Download Submit