f72bc45d565b57d1882d5df9d71ff8c4c82a10296d4c940dff9af30af7373197

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9df6ef47ffcec548015c380fd162fd0N.exe
Size

468KB
MD5

a9df6ef47ffcec548015c380fd162fd0
SHA1

8a88636693a86bb93f92037e43fca45bfcc1ea5b
SHA256

f72bc45d565b57d1882d5df9d71ff8c4c82a10296d4c940dff9af30af7373197
SHA512

ddd2e8d2b2f79d3aa78b4a6b52935740dc981e469967dc2e1a309cc305f39afff9151e02ba79c451cfc89c56a9e409c21c351ee81327ab82f12ac72f5763fd76
SSDEEP

3072:abAuorldI03YtbY2PzcIffT/ECXZ4umpnsHCOVhDbaUacS/7tQlw:abZoQOYtBP4IffohVkbaf3/7t

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2796	Unicorn-12832.exe
2832	Unicorn-20496.exe
2828	Unicorn-26992.exe
2808	Unicorn-53740.exe
3016	Unicorn-20710.exe
2968	Unicorn-844.exe
1208	Unicorn-62519.exe
1008	Unicorn-48658.exe
2112	Unicorn-48658.exe
2768	Unicorn-9571.exe
1236	Unicorn-24546.exe
484	Unicorn-56203.exe
2596	Unicorn-7687.exe
2780	Unicorn-27553.exe
2340	Unicorn-40713.exe
2912	Unicorn-34832.exe
820	Unicorn-6326.exe
2360	Unicorn-42637.exe
1724	Unicorn-27379.exe
1552	Unicorn-64266.exe
2476	Unicorn-6622.exe
1284	Unicorn-52294.exe
2052	Unicorn-6357.exe
872	Unicorn-27728.exe
1688	Unicorn-31898.exe
1660	Unicorn-9833.exe
1948	Unicorn-15964.exe
2304	Unicorn-62595.exe
1916	Unicorn-16924.exe
2060	Unicorn-54973.exe
2320	Unicorn-34732.exe
1332	Unicorn-63958.exe
1736	Unicorn-50793.exe
2928	Unicorn-10620.exe
1516	Unicorn-33772.exe
2684	Unicorn-53517.exe
3068	Unicorn-36268.exe
2700	Unicorn-25944.exe
2664	Unicorn-32075.exe
2600	Unicorn-4529.exe
832	Unicorn-44488.exe
1100	Unicorn-44488.exe
1704	Unicorn-24622.exe
2984	Unicorn-3777.exe
2568	Unicorn-49449.exe
1108	Unicorn-35272.exe
2704	Unicorn-15406.exe
1976	Unicorn-35272.exe
1908	Unicorn-50705.exe
236	Unicorn-50705.exe
296	Unicorn-44575.exe
1472	Unicorn-50440.exe
572	Unicorn-33134.exe
1396	Unicorn-41800.exe
536	Unicorn-59086.exe
2080	Unicorn-59086.exe
1872	Unicorn-19095.exe
2192	Unicorn-38431.exe
1656	Unicorn-34419.exe
1184	Unicorn-51720.exe
2092	Unicorn-57828.exe
1536	Unicorn-21739.exe
944	Unicorn-50162.exe
1460	Unicorn-47076.exe

Loads dropped DLL 64 IoCs

pid	Process
2632	a9df6ef47ffcec548015c380fd162fd0N.exe
2632	a9df6ef47ffcec548015c380fd162fd0N.exe
2796	Unicorn-12832.exe
2796	Unicorn-12832.exe
2632	a9df6ef47ffcec548015c380fd162fd0N.exe
2632	a9df6ef47ffcec548015c380fd162fd0N.exe
2832	Unicorn-20496.exe
2832	Unicorn-20496.exe
2828	Unicorn-26992.exe
2796	Unicorn-12832.exe
2828	Unicorn-26992.exe
2796	Unicorn-12832.exe
2632	a9df6ef47ffcec548015c380fd162fd0N.exe
2632	a9df6ef47ffcec548015c380fd162fd0N.exe
3016	Unicorn-20710.exe
2968	Unicorn-844.exe
3016	Unicorn-20710.exe
2968	Unicorn-844.exe
2808	Unicorn-53740.exe
2808	Unicorn-53740.exe
2796	Unicorn-12832.exe
2796	Unicorn-12832.exe
2828	Unicorn-26992.exe
2828	Unicorn-26992.exe
2832	Unicorn-20496.exe
1208	Unicorn-62519.exe
1208	Unicorn-62519.exe
2832	Unicorn-20496.exe
2632	a9df6ef47ffcec548015c380fd162fd0N.exe
2632	a9df6ef47ffcec548015c380fd162fd0N.exe
2112	Unicorn-48658.exe
2112	Unicorn-48658.exe
2968	Unicorn-844.exe
2968	Unicorn-844.exe
1008	Unicorn-48658.exe
1008	Unicorn-48658.exe
3016	Unicorn-20710.exe
3016	Unicorn-20710.exe
2768	Unicorn-9571.exe
2768	Unicorn-9571.exe
2808	Unicorn-53740.exe
484	Unicorn-56203.exe
2796	Unicorn-12832.exe
2808	Unicorn-53740.exe
484	Unicorn-56203.exe
2796	Unicorn-12832.exe
2596	Unicorn-7687.exe
2596	Unicorn-7687.exe
2828	Unicorn-26992.exe
2828	Unicorn-26992.exe
2832	Unicorn-20496.exe
2780	Unicorn-27553.exe
2832	Unicorn-20496.exe
2780	Unicorn-27553.exe
1208	Unicorn-62519.exe
1208	Unicorn-62519.exe
2340	Unicorn-40713.exe
2340	Unicorn-40713.exe
2632	a9df6ef47ffcec548015c380fd162fd0N.exe
2632	a9df6ef47ffcec548015c380fd162fd0N.exe
2912	Unicorn-34832.exe
2912	Unicorn-34832.exe
2112	Unicorn-48658.exe
2112	Unicorn-48658.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5492	2852	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54870.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2632	a9df6ef47ffcec548015c380fd162fd0N.exe
2796	Unicorn-12832.exe
2832	Unicorn-20496.exe
2828	Unicorn-26992.exe
3016	Unicorn-20710.exe
2808	Unicorn-53740.exe
2968	Unicorn-844.exe
1208	Unicorn-62519.exe
2112	Unicorn-48658.exe
2768	Unicorn-9571.exe
1008	Unicorn-48658.exe
2596	Unicorn-7687.exe
1236	Unicorn-24546.exe
2780	Unicorn-27553.exe
2340	Unicorn-40713.exe
484	Unicorn-56203.exe
2912	Unicorn-34832.exe
820	Unicorn-6326.exe
2360	Unicorn-42637.exe
1724	Unicorn-27379.exe
1552	Unicorn-64266.exe
2476	Unicorn-6622.exe
2052	Unicorn-6357.exe
1284	Unicorn-52294.exe
872	Unicorn-27728.exe
1688	Unicorn-31898.exe
1660	Unicorn-9833.exe
1948	Unicorn-15964.exe
2304	Unicorn-62595.exe
1916	Unicorn-16924.exe
2060	Unicorn-54973.exe
2320	Unicorn-34732.exe
1332	Unicorn-63958.exe
1736	Unicorn-50793.exe
2928	Unicorn-10620.exe
1516	Unicorn-33772.exe
2684	Unicorn-53517.exe
3068	Unicorn-36268.exe
2664	Unicorn-32075.exe
2700	Unicorn-25944.exe
2600	Unicorn-4529.exe
1100	Unicorn-44488.exe
832	Unicorn-44488.exe
1704	Unicorn-24622.exe
2984	Unicorn-3777.exe
2568	Unicorn-49449.exe
1108	Unicorn-35272.exe
1976	Unicorn-35272.exe
2704	Unicorn-15406.exe
1472	Unicorn-50440.exe
236	Unicorn-50705.exe
1908	Unicorn-50705.exe
296	Unicorn-44575.exe
1396	Unicorn-41800.exe
572	Unicorn-33134.exe
2080	Unicorn-59086.exe
536	Unicorn-59086.exe
1872	Unicorn-19095.exe
2192	Unicorn-38431.exe
1656	Unicorn-34419.exe
1184	Unicorn-51720.exe
2092	Unicorn-57828.exe
1536	Unicorn-21739.exe
944	Unicorn-50162.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2796	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	30
PID 2632 wrote to memory of 2796	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	30
PID 2632 wrote to memory of 2796	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	30
PID 2632 wrote to memory of 2796	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	30
PID 2796 wrote to memory of 2832	2796	Unicorn-12832.exe	31
PID 2796 wrote to memory of 2832	2796	Unicorn-12832.exe	31
PID 2796 wrote to memory of 2832	2796	Unicorn-12832.exe	31
PID 2796 wrote to memory of 2832	2796	Unicorn-12832.exe	31
PID 2632 wrote to memory of 2828	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	32
PID 2632 wrote to memory of 2828	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	32
PID 2632 wrote to memory of 2828	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	32
PID 2632 wrote to memory of 2828	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	32
PID 2832 wrote to memory of 2808	2832	Unicorn-20496.exe	33
PID 2832 wrote to memory of 2808	2832	Unicorn-20496.exe	33
PID 2832 wrote to memory of 2808	2832	Unicorn-20496.exe	33
PID 2832 wrote to memory of 2808	2832	Unicorn-20496.exe	33
PID 2828 wrote to memory of 3016	2828	Unicorn-26992.exe	34
PID 2828 wrote to memory of 3016	2828	Unicorn-26992.exe	34
PID 2828 wrote to memory of 3016	2828	Unicorn-26992.exe	34
PID 2828 wrote to memory of 3016	2828	Unicorn-26992.exe	34
PID 2796 wrote to memory of 2968	2796	Unicorn-12832.exe	35
PID 2796 wrote to memory of 2968	2796	Unicorn-12832.exe	35
PID 2796 wrote to memory of 2968	2796	Unicorn-12832.exe	35
PID 2796 wrote to memory of 2968	2796	Unicorn-12832.exe	35
PID 2632 wrote to memory of 1208	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	36
PID 2632 wrote to memory of 1208	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	36
PID 2632 wrote to memory of 1208	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	36
PID 2632 wrote to memory of 1208	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	36
PID 3016 wrote to memory of 1008	3016	Unicorn-20710.exe	37
PID 3016 wrote to memory of 1008	3016	Unicorn-20710.exe	37
PID 3016 wrote to memory of 1008	3016	Unicorn-20710.exe	37
PID 3016 wrote to memory of 1008	3016	Unicorn-20710.exe	37
PID 2968 wrote to memory of 2112	2968	Unicorn-844.exe	38
PID 2968 wrote to memory of 2112	2968	Unicorn-844.exe	38
PID 2968 wrote to memory of 2112	2968	Unicorn-844.exe	38
PID 2968 wrote to memory of 2112	2968	Unicorn-844.exe	38
PID 2808 wrote to memory of 2768	2808	Unicorn-53740.exe	39
PID 2808 wrote to memory of 2768	2808	Unicorn-53740.exe	39
PID 2808 wrote to memory of 2768	2808	Unicorn-53740.exe	39
PID 2808 wrote to memory of 2768	2808	Unicorn-53740.exe	39
PID 2796 wrote to memory of 1236	2796	Unicorn-12832.exe	40
PID 2796 wrote to memory of 1236	2796	Unicorn-12832.exe	40
PID 2796 wrote to memory of 1236	2796	Unicorn-12832.exe	40
PID 2796 wrote to memory of 1236	2796	Unicorn-12832.exe	40
PID 2828 wrote to memory of 484	2828	Unicorn-26992.exe	41
PID 2828 wrote to memory of 484	2828	Unicorn-26992.exe	41
PID 2828 wrote to memory of 484	2828	Unicorn-26992.exe	41
PID 2828 wrote to memory of 484	2828	Unicorn-26992.exe	41
PID 1208 wrote to memory of 2780	1208	Unicorn-62519.exe	43
PID 1208 wrote to memory of 2780	1208	Unicorn-62519.exe	43
PID 1208 wrote to memory of 2780	1208	Unicorn-62519.exe	43
PID 1208 wrote to memory of 2780	1208	Unicorn-62519.exe	43
PID 2832 wrote to memory of 2596	2832	Unicorn-20496.exe	42
PID 2832 wrote to memory of 2596	2832	Unicorn-20496.exe	42
PID 2832 wrote to memory of 2596	2832	Unicorn-20496.exe	42
PID 2832 wrote to memory of 2596	2832	Unicorn-20496.exe	42
PID 2632 wrote to memory of 2340	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	44
PID 2632 wrote to memory of 2340	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	44
PID 2632 wrote to memory of 2340	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	44
PID 2632 wrote to memory of 2340	2632	a9df6ef47ffcec548015c380fd162fd0N.exe	44
PID 2112 wrote to memory of 2912	2112	Unicorn-48658.exe	45
PID 2112 wrote to memory of 2912	2112	Unicorn-48658.exe	45
PID 2112 wrote to memory of 2912	2112	Unicorn-48658.exe	45
PID 2112 wrote to memory of 2912	2112	Unicorn-48658.exe	45

C:\Users\Admin\AppData\Local\Temp\a9df6ef47ffcec548015c380fd162fd0N.exe
"C:\Users\Admin\AppData\Local\Temp\a9df6ef47ffcec548015c380fd162fd0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53740.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        8⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        9⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6532.exe
        9⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37785.exe
        9⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        8⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52659.exe
        9⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12527.exe
        9⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
        8⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        8⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        8⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        7⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        8⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        8⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
        8⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        7⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9484.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56625.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe
        8⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        8⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
        8⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        7⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
        7⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56063.exe
        6⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        7⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43060.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62649.exe
        6⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        7⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27121.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31983.exe
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49993.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        8⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64961.exe
        9⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        9⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35261.exe
        9⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        8⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
        6⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        7⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 216
        7⤵
        Program crash
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        6⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-554.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
        6⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        7⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        6⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        5⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        6⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-343.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
        5⤵
        
        PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7687.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
        6⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        7⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39270.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        7⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49212.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37822.exe
        6⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61649.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10792.exe
        7⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35749.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
        5⤵
        
        PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22016.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9833.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20767.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        7⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        6⤵
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7515.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39841.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50440.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51320.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        6⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16498.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35749.exe
        5⤵
        
        PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34847.exe
      4⤵
      PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57930.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17408.exe
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-844.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48658.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
        8⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        8⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe
        8⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        8⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33514.exe
        7⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9180.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        7⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51720.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
        7⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        7⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        7⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63958.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57828.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10763.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
        7⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        6⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34063.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5239.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6326.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50793.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        7⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5902.exe
        7⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
        6⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17838.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
        5⤵
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65410.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62649.exe
        5⤵
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        5⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20767.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51313.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22062.exe
        6⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        5⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43079.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20501.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25689.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
      4⤵
      PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
      4⤵
      PID:6972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
      4⤵
      PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18850.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57454.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe
      4⤵
      PID:6804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6357.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64048.exe
        5⤵
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5449.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
      4⤵
      PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14837.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48245.exe
      4⤵
      PID:7036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43780.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32081.exe
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9569.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
      4⤵
      PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
    3⤵
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
      4⤵
      PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe
      4⤵
      PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
    3⤵
    PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43055.exe
      4⤵
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
      4⤵
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
      4⤵
      PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47653.exe
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23408.exe
    3⤵
    PID:6340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48658.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33772.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        7⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64961.exe
        8⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
        8⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe
        8⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57736.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        7⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        6⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        7⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35498.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38077.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        6⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        7⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        8⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43079.exe
        8⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        8⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        7⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        6⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        7⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe
        7⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12376.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
        5⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22504.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62649.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37055.exe
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
        6⤵
        Executes dropped EXE
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        7⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        6⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52504.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        6⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52156.exe
        5⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        5⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3628.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        5⤵
        
        PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        5⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        5⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43079.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62540.exe
      4⤵
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
        5⤵
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57736.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
        5⤵
        
        PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
      4⤵
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36175.exe
      4⤵
      PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5239.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56203.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3777.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61131.exe
        6⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23142.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36993.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        5⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48805.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4728.exe
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
      4⤵
      PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31898.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9407.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        5⤵
        
        PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36993.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
      4⤵
      PID:6892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
      4⤵
      PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1102.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
      4⤵
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
    3⤵
    PID:2900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
    3⤵
    PID:3976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25525.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25949.exe
    3⤵
    PID:6556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15964.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44488.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        6⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25866.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        7⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        7⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        7⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55509.exe
        5⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41033.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        5⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54935.exe
        5⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12368.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25042.exe
      4⤵
      PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51881.exe
      4⤵
      PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
      4⤵
      PID:6256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20767.exe
        5⤵
        
        PID:340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20453.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        5⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        6⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5356.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
      4⤵
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
      4⤵
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        5⤵
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62128.exe
      4⤵
      PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61181.exe
      4⤵
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4726.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
      4⤵
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61842.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        5⤵
        
        PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
      4⤵
      PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
    3⤵
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
      4⤵
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45817.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53984.exe
    3⤵
    PID:108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
      4⤵
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30177.exe
      4⤵
      PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
    3⤵
    PID:3308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe
    3⤵
    PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24543.exe
    3⤵
    PID:6400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16924.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44488.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65232.exe
        5⤵
        
        PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        5⤵
        
        PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42730.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        5⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
        6⤵
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50290.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        6⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33776.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59454.exe
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
      4⤵
      PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
      4⤵
      PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59171.exe
    3⤵
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
      4⤵
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23195.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21100.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16498.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45544.exe
      4⤵
      PID:6312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54670.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
      4⤵
      PID:5348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56920.exe
    3⤵
    PID:3440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26772.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36904.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
      4⤵
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21094.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        5⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
      4⤵
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17117.exe
      4⤵
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
      4⤵
      PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55509.exe
    3⤵
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6299.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
    3⤵
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33845.exe
      4⤵
      PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37256.exe
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57736.exe
    3⤵
    PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
    3⤵
    PID:5716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe
    3⤵
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22062.exe
      4⤵
      PID:6992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
    3⤵
    PID:4548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
    3⤵
    PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
    3⤵
    PID:6884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
  2⤵
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29273.exe
    3⤵
    PID:1932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
    3⤵
    PID:5672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
  2⤵
  PID:1836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
  2⤵
  PID:3896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14858.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14858.exe
  2⤵
  PID:4128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7804.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7804.exe
  2⤵
  PID:6016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
  2⤵
  PID:6824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe

Filesize
468KB

MD5
b41dc23d7df2fc20bb027622ebc3e19b

SHA1
42c4d439c15fb2a2a83ebe2b8de8836616dfcd8d

SHA256
baf7f5adae8f172921b894f707f4aca1eaf564bc9581b2d39ff814d3446e10ca

SHA512
e3b8fcb915dccf5922c2c9311c37ca294cbb2876acb0b9bf76b9c2fb4396d17a1fcd39ba7cae47ab5831b74b93f1756271e3144ca668d96ef0020fbb9bc7fdd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe

Filesize
468KB

MD5
dc3fe52c8cc37e4d21d93e76da54a8fd

SHA1
59bd3d00ed017a9f841ea8e96c18bb7b1820ed15

SHA256
188ef88a4a92df6406af3fdc85c9c6465cf88511eb2b4cd8eca95c10cb4f2e5a

SHA512
341145cb9787e362204ac2e25b836b363061b37c2b17dc2aab832d7e704db01cdb49df430f97013a020c406fd11e700de0b9d17928b186f12b330096651f478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe

Filesize
468KB

MD5
39e6b1ff527b1e80bd2ce94675948f0d

SHA1
37bf0181543fe9333c15038deb1d1e4ea702864d

SHA256
03afd0655a7c5ffd67269da3dd88ca8175af1efda71555c626f8d1ad65650af9

SHA512
7c105647d3c952e06258043e8bd5a78029540fb0129daeff4d8bbf851bfc6460d79b0e3995c1f81d3ede0a57ab42c4c71932a8966fc7cacbb19ad144226aa236

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe

Filesize
468KB

MD5
85f679e5494484b186c10d7ee1be7094

SHA1
68fea2b6e52f68d29a57c7e66b317f5e16d63fa1

SHA256
5e29233177131635038dae9c2536b6429d54114aa0d029d15e654cf34982b2de

SHA512
e6be612dad64705c454f7b3381848b5254d84747ec2bef44ebc8b8f9f11e51312a3e1ae72097dfc8df311677cd5921ee34b9ecc7376f437a92d6f4f788e56469

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe

Filesize
468KB

MD5
90da0591723ad9bf3d12ac602bdc9db4

SHA1
a68c7e2ef64a58095dc22422b90ff2b68fe4fe89

SHA256
5606e1385177f915bb42ae5b82910449e61a5c20d883b5ef12314aaaf323d640

SHA512
b451b76d8d7b9f151b90226251c937273a76012745b5d4dd368815a6eba5c6e492403f0d52dcf396e681b7b9a5616dc736bf0130c672d6ea752b7a9e5060424e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe

Filesize
468KB

MD5
41eedee8141180e850a78c9b1e8d84b1

SHA1
102b9dc36c6988f43c1c4e920801364a2e4eccf9

SHA256
98c9e59256fe85f0248039b9017d833eedbf7d6e32793e07a5f371769b7108be

SHA512
6b0339b7f62ea279b10cb53c8c9dfc2132c5670d7a1cb99f6dfcaf9d2031574749068cd520a9729a7978bd3f7809c59e016a03206befab698b345a8dd22de231

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48658.exe

Filesize
468KB

MD5
b92e3e8d1ad5aa42e9824d9c70d3fa5a

SHA1
1747efcf9b7b9a75f70e0cfab64029c4b935309f

SHA256
59f83166ed42baa5179b4e7a737be260db9d3a9ca3b07b288c5d7b5961b364f9

SHA512
49eab40470db76af1e8fc5f4885d56e40fac609a0038bb39806c46051565897944067696d6119dd9721423045a5a72a43a2d6dbdf80cac0a822765c565c9cb45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56203.exe

Filesize
468KB

MD5
5b01990358756d8c6d9aaed6f7afea31

SHA1
c1e24f76430d51b271c557a193180a0480df67c7

SHA256
e75c2b65b68cfd76dd44f5c6d8b336ed0d345660a1aab46238f995dcf6c5dba5

SHA512
102a0de855f5e591352297a9a1e8efbb0628269de735c69b864f04006bf40d10c4fce5aafa9200aeb4a1e2ccfab13b57f177c22731556101c2dfdc6231f2625c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6326.exe

Filesize
468KB

MD5
05a42fcef37d41c1bb5423493928e54b

SHA1
3ef038dde4ffe3626867264535c25413e7d36bc4

SHA256
3e0fedf9f1500aff45d526c20ce8133a8922972d2ad96150c79939ad78b473e9

SHA512
b9fb906e1b95def2ac8d7ac05defe2c6bac510a6101246ac9d6fa4c441bbf358a2bf5a81a36c168de54ac7fc0cdddce8ca337a046e17e25c3b11187bfc11dd1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7687.exe

Filesize
468KB

MD5
f630ae00f54b8d858310f81a02fd8a97

SHA1
3f2d75c25df1fc0753f065e4837cc42a42ad1485

SHA256
3c7dae4ef53daff5def2f906a005e3869d194ad2fc806139f3542ff1cd0571db

SHA512
fecf5324ab9315dc1629edf0a80482066758bea89144fc85ac6d9b834cfb090b9c80dfd12378fe81dd6c5b2cbf09eb70295b22a414c415af3d4a7dc407400794

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-844.exe

Filesize
468KB

MD5
648ced423a7d2144cb9dd412ceee60d0

SHA1
4a88428f7b4a04f48622aef877a82b568a88601a

SHA256
9674b4aa8ab7c08f7c4cfb44cc4df8983ba0b536575e6c268c04ab0d9f32ab71

SHA512
8c4e5667b1bb86595ab44e05cd455e2c8911d4782f76a7970d9c93cddd149e2840347ba546e3f6f8a075b8c3d979a6ea52da6ec9e8f7d23e0f16954f4e4668e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe

Filesize
468KB

MD5
6d8a356b4eca1dba5ea09dabbbcdf9e8

SHA1
62367686bd6e877eae9fdc96100c3ae296b6bf92

SHA256
1218e92fe95ca7587fb357491b3b330046b3a2ce50a6ea38d9f041ae5c44a61d

SHA512
78c20ea74babadad5bcb2d0aea4e6dca3884efbb1a8aa9b91c7e65761fdda93baf688edb4680b0f6c4ce8b47f808d1872bc457512ad4e6986e1b46f8323418ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe

Filesize
468KB

MD5
9dec0d69144164662c08eb5a8aea380d

SHA1
46713d012d5fed32fad2e85ac24bbf4e038ade75

SHA256
e4ce3bf9898c449f9c34d924ea4bf07f471b1980cb92bfe9f24b0ebd075cbf48

SHA512
fb46f177240eea92e2f707c772901be644b23a90e14549d8ebb29fc73de31dfa88405c8973667ca3cdc75c50e38fdf37505e317be4318137f06567ab9de09162

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe

Filesize
468KB

MD5
8548ab0326d4b0a09d42a0fcc67a3908

SHA1
1a2d0531f4da762eb0986e73b9b03e9cf1aea2e1

SHA256
5b03036ea0e4e94fcbc787faa34b6c4f337e573e1fa98319dcc60c00c737a616

SHA512
ca41be3cb907f9b87d1be8398adab948a10a00ec5b73fcd30027ba51e476c5b9e712c78bf770923582372ae7c4079b3bdfdaac2cb1de1b6bc322f788112b2cff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe

Filesize
468KB

MD5
bdfea6a58e8bc3a9354ef443d5b0b8cd

SHA1
f3f3ee6ce7e56b74419a3252b70416e9cbe1f942

SHA256
22fdb3c502691600fc9eac78c8e5a96e073a712f8dc999b47d30e80d276570c4

SHA512
41e84214a0babe356c17a64212f1d9fbb4c50cbbf49be960e1372360c3f6471cd530e8c4e0cd78df625a60060c4457ed164b8fb6e0c1c31a24a526847d10ae53

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe

Filesize
468KB

MD5
9327c2e8d3569d92e5078f20c66d5f54

SHA1
a545bb37faf498756294c90a6c9625d47d3d79a6

SHA256
9cd7dad37fb90e2dce7333e20957658d5a7311f087b9a1cededc2303e0a9dfb0

SHA512
98bdb16bda7211a1ed0508518ef2e7efc1a32876421643d996f32da56bfae08efceb0c1bb2e4cba1a71586ab0fe27af67c7cb39f45ea396fbfe0281934b50eb0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53740.exe

Filesize
468KB

MD5
e0d6ae133f748d091824eefc3646e126

SHA1
41abae6d8bb5ba66a7bfc68f9905496ca94d2e3f

SHA256
64a76e9c37ad54ed26b8291c21c3ab606166eaaf345e6d093a8fdda37b635437

SHA512
c20dc0eb0b04ee7542cd41d91999f38fb71fe37544968c164e65d1cb5fc308bc327a639de39dc54018f66977f31ac873ab5ea1cbe8788cde86fb0768d7f362db

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe

Filesize
468KB

MD5
bed977fbbc0a665c27342ba3a8f5bae7

SHA1
98c004a3c53ecd002e08e2c2eb84bdaa2b02178a

SHA256
5edd9962ddda9268a6595221df02ec59322bb5b6c59e97a48f2a6dfd990c5574

SHA512
ba64c2718a8d85561a3320bfa48e0cabfd13a6bb27955daa9c53748cf39be0fc0b1b9a1bfed13260819c1227e555e972c3ac22bcbf022795343be78d162678d5

Download Submit