22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
Size

468KB
MD5

bca6fd815d2c39f6bc6837399c8ce57e
SHA1

57efab7285b047ea8997bf9e722e4a472a915dc5
SHA256

22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81
SHA512

ef73eeacbdd58c3b0b2940ffadb00eb0ff0dd09c5d47631923238d7b79e16b89350dcc3efd12a2be03477ed877b9d04b7fdd2cfaeddd6560a10917b275fe692e
SSDEEP

3072:5nuTotIKIG5UMbY1Hz4OrfJ/zCZsP0EwnLHewVgh7GZLTaKgxklq:5nyowCUM6HcOrfvNx37G1OKgx

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2480	Unicorn-33982.exe
2352	Unicorn-31604.exe
2356	Unicorn-44371.exe
2820	Unicorn-43385.exe
2692	Unicorn-58330.exe
2720	Unicorn-6528.exe
2612	Unicorn-42076.exe
2624	Unicorn-24994.exe
2396	Unicorn-48875.exe
2044	Unicorn-33930.exe
2736	Unicorn-27799.exe
1404	Unicorn-33930.exe
320	Unicorn-62253.exe
1196	Unicorn-56872.exe
880	Unicorn-2273.exe
2660	Unicorn-61496.exe
2364	Unicorn-43022.exe
2196	Unicorn-36892.exe
408	Unicorn-52814.exe
3036	Unicorn-7142.exe
1120	Unicorn-7142.exe
836	Unicorn-34339.exe
1312	Unicorn-54205.exe
696	Unicorn-34339.exe
972	Unicorn-54205.exe
1964	Unicorn-40318.exe
1384	Unicorn-45275.exe
1684	Unicorn-14708.exe
1000	Unicorn-52212.exe
904	Unicorn-43297.exe
3016	Unicorn-38948.exe
2024	Unicorn-8294.exe
1008	Unicorn-56680.exe
1088	Unicorn-53987.exe
1824	Unicorn-12954.exe
1352	Unicorn-44236.exe
1680	Unicorn-10816.exe
2484	Unicorn-4686.exe
2340	Unicorn-14900.exe
2744	Unicorn-27153.exe
2700	Unicorn-18985.exe
2760	Unicorn-55833.exe
2772	Unicorn-46182.exe
2860	Unicorn-64001.exe
2716	Unicorn-9233.exe
1136	Unicorn-57064.exe
2568	Unicorn-42119.exe
2600	Unicorn-62274.exe
1028	Unicorn-62539.exe
1396	Unicorn-35897.exe
2900	Unicorn-44372.exe
2296	Unicorn-33866.exe
2544	Unicorn-59332.exe
2728	Unicorn-31298.exe
1264	Unicorn-55824.exe
2132	Unicorn-41988.exe
2144	Unicorn-18876.exe
328	Unicorn-41334.exe
2656	Unicorn-28990.exe
684	Unicorn-28990.exe
1600	Unicorn-22005.exe
2220	Unicorn-11070.exe
1740	Unicorn-12461.exe
2516	Unicorn-45902.exe

Loads dropped DLL 64 IoCs

pid	Process
2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
2480	Unicorn-33982.exe
2480	Unicorn-33982.exe
2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
2352	Unicorn-31604.exe
2352	Unicorn-31604.exe
2480	Unicorn-33982.exe
2480	Unicorn-33982.exe
2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
2356	Unicorn-44371.exe
2356	Unicorn-44371.exe
2820	Unicorn-43385.exe
2820	Unicorn-43385.exe
2352	Unicorn-31604.exe
2352	Unicorn-31604.exe
2720	Unicorn-6528.exe
2692	Unicorn-58330.exe
2480	Unicorn-33982.exe
2720	Unicorn-6528.exe
2692	Unicorn-58330.exe
2480	Unicorn-33982.exe
2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
2612	Unicorn-42076.exe
2612	Unicorn-42076.exe
2356	Unicorn-44371.exe
2356	Unicorn-44371.exe
2396	Unicorn-48875.exe
2396	Unicorn-48875.exe
2624	Unicorn-24994.exe
2624	Unicorn-24994.exe
2352	Unicorn-31604.exe
2352	Unicorn-31604.exe
2820	Unicorn-43385.exe
2820	Unicorn-43385.exe
1404	Unicorn-33930.exe
320	Unicorn-62253.exe
320	Unicorn-62253.exe
1404	Unicorn-33930.exe
2692	Unicorn-58330.exe
2720	Unicorn-6528.exe
2044	Unicorn-33930.exe
2736	Unicorn-27799.exe
2736	Unicorn-27799.exe
2692	Unicorn-58330.exe
2720	Unicorn-6528.exe
2044	Unicorn-33930.exe
2480	Unicorn-33982.exe
2480	Unicorn-33982.exe
2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
1196	Unicorn-56872.exe
1196	Unicorn-56872.exe
2612	Unicorn-42076.exe
2612	Unicorn-42076.exe
880	Unicorn-2273.exe
880	Unicorn-2273.exe
2356	Unicorn-44371.exe
2356	Unicorn-44371.exe
2660	Unicorn-61496.exe
2660	Unicorn-61496.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	920	WerFault.exe	125

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41487.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
2480	Unicorn-33982.exe
2352	Unicorn-31604.exe
2356	Unicorn-44371.exe
2820	Unicorn-43385.exe
2692	Unicorn-58330.exe
2720	Unicorn-6528.exe
2612	Unicorn-42076.exe
2396	Unicorn-48875.exe
2624	Unicorn-24994.exe
2044	Unicorn-33930.exe
2736	Unicorn-27799.exe
1404	Unicorn-33930.exe
320	Unicorn-62253.exe
1196	Unicorn-56872.exe
880	Unicorn-2273.exe
2660	Unicorn-61496.exe
2364	Unicorn-43022.exe
2196	Unicorn-36892.exe
696	Unicorn-34339.exe
1120	Unicorn-7142.exe
408	Unicorn-52814.exe
3036	Unicorn-7142.exe
836	Unicorn-34339.exe
972	Unicorn-54205.exe
1312	Unicorn-54205.exe
1384	Unicorn-45275.exe
1964	Unicorn-40318.exe
1684	Unicorn-14708.exe
1000	Unicorn-52212.exe
904	Unicorn-43297.exe
3016	Unicorn-38948.exe
2024	Unicorn-8294.exe
1008	Unicorn-56680.exe
1088	Unicorn-53987.exe
1824	Unicorn-12954.exe
1352	Unicorn-44236.exe
1680	Unicorn-10816.exe
2484	Unicorn-4686.exe
2340	Unicorn-14900.exe
2744	Unicorn-27153.exe
2700	Unicorn-18985.exe
2760	Unicorn-55833.exe
2772	Unicorn-46182.exe
2860	Unicorn-64001.exe
2716	Unicorn-9233.exe
1136	Unicorn-57064.exe
2568	Unicorn-42119.exe
1028	Unicorn-62539.exe
2600	Unicorn-62274.exe
2900	Unicorn-44372.exe
2728	Unicorn-31298.exe
1396	Unicorn-35897.exe
2544	Unicorn-59332.exe
2296	Unicorn-33866.exe
1264	Unicorn-55824.exe
2144	Unicorn-18876.exe
2132	Unicorn-41988.exe
328	Unicorn-41334.exe
2656	Unicorn-28990.exe
684	Unicorn-28990.exe
1600	Unicorn-22005.exe
1740	Unicorn-12461.exe
2220	Unicorn-11070.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2480	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	31
PID 2256 wrote to memory of 2480	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	31
PID 2256 wrote to memory of 2480	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	31
PID 2256 wrote to memory of 2480	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	31
PID 2256 wrote to memory of 2352	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	33
PID 2256 wrote to memory of 2352	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	33
PID 2256 wrote to memory of 2352	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	33
PID 2256 wrote to memory of 2352	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	33
PID 2480 wrote to memory of 2356	2480	Unicorn-33982.exe	32
PID 2480 wrote to memory of 2356	2480	Unicorn-33982.exe	32
PID 2480 wrote to memory of 2356	2480	Unicorn-33982.exe	32
PID 2480 wrote to memory of 2356	2480	Unicorn-33982.exe	32
PID 2352 wrote to memory of 2820	2352	Unicorn-31604.exe	34
PID 2352 wrote to memory of 2820	2352	Unicorn-31604.exe	34
PID 2352 wrote to memory of 2820	2352	Unicorn-31604.exe	34
PID 2352 wrote to memory of 2820	2352	Unicorn-31604.exe	34
PID 2480 wrote to memory of 2692	2480	Unicorn-33982.exe	35
PID 2480 wrote to memory of 2692	2480	Unicorn-33982.exe	35
PID 2480 wrote to memory of 2692	2480	Unicorn-33982.exe	35
PID 2480 wrote to memory of 2692	2480	Unicorn-33982.exe	35
PID 2256 wrote to memory of 2720	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	36
PID 2256 wrote to memory of 2720	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	36
PID 2256 wrote to memory of 2720	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	36
PID 2256 wrote to memory of 2720	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	36
PID 2356 wrote to memory of 2612	2356	Unicorn-44371.exe	37
PID 2356 wrote to memory of 2612	2356	Unicorn-44371.exe	37
PID 2356 wrote to memory of 2612	2356	Unicorn-44371.exe	37
PID 2356 wrote to memory of 2612	2356	Unicorn-44371.exe	37
PID 2820 wrote to memory of 2624	2820	Unicorn-43385.exe	38
PID 2820 wrote to memory of 2624	2820	Unicorn-43385.exe	38
PID 2820 wrote to memory of 2624	2820	Unicorn-43385.exe	38
PID 2820 wrote to memory of 2624	2820	Unicorn-43385.exe	38
PID 2352 wrote to memory of 2396	2352	Unicorn-31604.exe	39
PID 2352 wrote to memory of 2396	2352	Unicorn-31604.exe	39
PID 2352 wrote to memory of 2396	2352	Unicorn-31604.exe	39
PID 2352 wrote to memory of 2396	2352	Unicorn-31604.exe	39
PID 2720 wrote to memory of 1404	2720	Unicorn-6528.exe	40
PID 2720 wrote to memory of 1404	2720	Unicorn-6528.exe	40
PID 2720 wrote to memory of 1404	2720	Unicorn-6528.exe	40
PID 2720 wrote to memory of 1404	2720	Unicorn-6528.exe	40
PID 2692 wrote to memory of 2044	2692	Unicorn-58330.exe	41
PID 2692 wrote to memory of 2044	2692	Unicorn-58330.exe	41
PID 2692 wrote to memory of 2044	2692	Unicorn-58330.exe	41
PID 2692 wrote to memory of 2044	2692	Unicorn-58330.exe	41
PID 2480 wrote to memory of 2736	2480	Unicorn-33982.exe	42
PID 2480 wrote to memory of 2736	2480	Unicorn-33982.exe	42
PID 2480 wrote to memory of 2736	2480	Unicorn-33982.exe	42
PID 2480 wrote to memory of 2736	2480	Unicorn-33982.exe	42
PID 2256 wrote to memory of 320	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	43
PID 2256 wrote to memory of 320	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	43
PID 2256 wrote to memory of 320	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	43
PID 2256 wrote to memory of 320	2256	22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe	43
PID 2612 wrote to memory of 1196	2612	Unicorn-42076.exe	44
PID 2612 wrote to memory of 1196	2612	Unicorn-42076.exe	44
PID 2612 wrote to memory of 1196	2612	Unicorn-42076.exe	44
PID 2612 wrote to memory of 1196	2612	Unicorn-42076.exe	44
PID 2356 wrote to memory of 880	2356	Unicorn-44371.exe	45
PID 2356 wrote to memory of 880	2356	Unicorn-44371.exe	45
PID 2356 wrote to memory of 880	2356	Unicorn-44371.exe	45
PID 2356 wrote to memory of 880	2356	Unicorn-44371.exe	45
PID 2396 wrote to memory of 2660	2396	Unicorn-48875.exe	46
PID 2396 wrote to memory of 2660	2396	Unicorn-48875.exe	46
PID 2396 wrote to memory of 2660	2396	Unicorn-48875.exe	46
PID 2396 wrote to memory of 2660	2396	Unicorn-48875.exe	46

C:\Users\Admin\AppData\Local\Temp\22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe
"C:\Users\Admin\AppData\Local\Temp\22cbf572c93d3ee926a57ceda036da5dfc0f193d990497639f99f40c3ce8ca81.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33982.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33982.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44371.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42076.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14708.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exe
        8⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52067.exe
        9⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        9⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        9⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        9⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        9⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32720.exe
        8⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        8⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        8⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        8⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        8⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36425.exe
        7⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exe
        8⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
        8⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        7⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        7⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        7⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        8⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        8⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        7⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8368.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51260.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14241.exe
        7⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exe
        6⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10284.exe
        7⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61254.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12167.exe
        6⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        6⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52212.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18876.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
        7⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
        8⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        8⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
        8⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10920.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
        7⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39139.exe
        6⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
        7⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        7⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        7⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41334.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        6⤵
        
        PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16913.exe
        5⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51414.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24951.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        5⤵
        
        PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
        5⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        5⤵
        
        PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39810.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33343.exe
        8⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        8⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
        8⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42830.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        7⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        7⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        7⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41002.exe
        6⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
        7⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
        7⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39855.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55413.exe
        6⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
        6⤵
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        6⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17767.exe
        6⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8014.exe
        6⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        5⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
        5⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
        5⤵
        
        PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        6⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        6⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        6⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        5⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8699.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        6⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        6⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        5⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        5⤵
        
        PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26520.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        5⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        5⤵
        
        PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
      4⤵
      PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
      4⤵
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
      4⤵
      PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49968.exe
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4949.exe
      4⤵
      PID:7840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54205.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14900.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        7⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5336.exe
        8⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        9⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        9⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        9⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8014.exe
        9⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
        8⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
        7⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        8⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17147.exe
        8⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
        8⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        8⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9851.exe
        8⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        7⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        7⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65315.exe
        6⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39810.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        7⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
        7⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        6⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34584.exe
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46685.exe
        6⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61126.exe
        5⤵
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        5⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        5⤵
        
        PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
        6⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39290.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        7⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32720.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20582.exe
        5⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37338.exe
        6⤵
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        5⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        5⤵
        
        PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        5⤵
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe
        6⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        6⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        5⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4773.exe
        5⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        5⤵
        
        PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41745.exe
      4⤵
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65321.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31116.exe
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        5⤵
        
        PID:7948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
      4⤵
      PID:7280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54205.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59332.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30334.exe
        6⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22488.exe
        7⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62544.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52020.exe
        7⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        6⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23401.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        6⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        6⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16498.exe
        5⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe
        6⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        6⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8898.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46794.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        5⤵
        
        PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31298.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48040.exe
        5⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        6⤵
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        6⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        5⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        5⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        5⤵
        
        PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
      4⤵
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exe
        5⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
        5⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        5⤵
        
        PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
      4⤵
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
      4⤵
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
      4⤵
      PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40318.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60567.exe
        5⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53026.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        6⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        5⤵
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        5⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        5⤵
        
        PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
      4⤵
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
      4⤵
      PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22269.exe
      4⤵
      PID:7916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
      4⤵
      PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
      4⤵
      PID:8108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48581.exe
    3⤵
    PID:4280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17943.exe
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
    3⤵
    PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
    3⤵
    PID:6504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
    3⤵
    PID:7200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        6⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
        7⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25184.exe
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        6⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
        6⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46831.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        6⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        6⤵
        
        PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30846.exe
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        6⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4538.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        5⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        5⤵
        
        PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52814.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52741.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54962.exe
        6⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        6⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44703.exe
        5⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33697.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57848.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        6⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11645.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4814.exe
        5⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63881.exe
        5⤵
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        5⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        5⤵
        
        PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        5⤵
        
        PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8898.exe
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46794.exe
      4⤵
      PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
      4⤵
      PID:7232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12461.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63468.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21039.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10322.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        7⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        6⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe
        5⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28850.exe
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        7⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30639.exe
        6⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57391.exe
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        6⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        5⤵
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        5⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
        5⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
        5⤵
        
        PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
        5⤵
        Executes dropped EXE
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38485.exe
        7⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2373.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        6⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54885.exe
        6⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19813.exe
        5⤵
        
        PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
        5⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        5⤵
        
        PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
      4⤵
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        5⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
      4⤵
      PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
      4⤵
      PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
      4⤵
      PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
      4⤵
      PID:7796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exe
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exe
        6⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        5⤵
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36809.exe
      4⤵
      PID:112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50931.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        5⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        5⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31680.exe
        5⤵
        
        PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27981.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
      4⤵
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
      4⤵
      PID:7328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62274.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63364.exe
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
      4⤵
      PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
      4⤵
      PID:7508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
    3⤵
    PID:3932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
    3⤵
    PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-720.exe
    3⤵
    PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
    3⤵
    PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27761.exe
    3⤵
    PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53004.exe
    3⤵
    PID:7676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exe
        6⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
        7⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40478.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        7⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52020.exe
        7⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49337.exe
        6⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4192.exe
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        6⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
        6⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13592.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        6⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        6⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        6⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25184.exe
        5⤵
        
        PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        5⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58247.exe
        5⤵
        
        PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        5⤵
        
        PID:596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56391.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8714.exe
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        6⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46685.exe
        6⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        5⤵
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        5⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        5⤵
        
        PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
      4⤵
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39290.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        5⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        5⤵
        
        PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44271.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
      4⤵
      PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
      4⤵
      PID:7312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27153.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        5⤵
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        6⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        6⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        6⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        5⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37205.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57848.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
        6⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        6⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47136.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        5⤵
        
        PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63260.exe
      4⤵
      PID:920
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 220
        5⤵
        Program crash
        
        PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
      4⤵
      PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56893.exe
      4⤵
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13302.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46685.exe
      4⤵
      PID:7816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22488.exe
      4⤵
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
      4⤵
      PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
      4⤵
      PID:7616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
    3⤵
    PID:700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
    3⤵
    PID:3388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
    3⤵
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
    3⤵
    PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
    3⤵
    PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12167.exe
    3⤵
    PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
    3⤵
    PID:7972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18985.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22488.exe
        5⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        5⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        5⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
        5⤵
        
        PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23810.exe
      4⤵
      PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23401.exe
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47705.exe
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
      4⤵
      PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
      4⤵
      PID:7440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57064.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34392.exe
      4⤵
      PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39130.exe
      4⤵
      PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
      4⤵
      PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
      4⤵
      PID:7688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57582.exe
    3⤵
    PID:2316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
    3⤵
    PID:3220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
    3⤵
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64674.exe
    3⤵
    PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
    3⤵
    PID:5564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3883.exe
    3⤵
    PID:6324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe
    3⤵
    PID:7484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45275.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
      4⤵
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14978.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        5⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        5⤵
        
        PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42830.exe
      4⤵
      PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55637.exe
      4⤵
      PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52020.exe
      4⤵
      PID:7984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4442.exe
    3⤵
    PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
    3⤵
    PID:3840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7240.exe
    3⤵
    PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63131.exe
    3⤵
    PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26469.exe
    3⤵
    PID:7880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
    3⤵
    PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
      4⤵
      PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7568.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52697.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
      4⤵
      PID:7660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
    3⤵
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
    3⤵
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42830.exe
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18503.exe
    3⤵
    PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
    3⤵
    PID:7640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
  2⤵
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53266.exe
    3⤵
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
    3⤵
    PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
    3⤵
    PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
    3⤵
    PID:7860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4181.exe
  2⤵
  PID:3320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
  2⤵
  PID:3580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38671.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38671.exe
  2⤵
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
  2⤵
  PID:5980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
  2⤵
  PID:7224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe

Filesize
468KB

MD5
47cf13b2abc28d9f27ca9c466ea0430e

SHA1
f27556767b656f9c8c67eafcdcb5c26425cc3ac3

SHA256
5bc8ebd541e8ca9574f2eeec9b895fb262d7700b7488130b0f0aca50660ba5e7

SHA512
13171fd9f4365dab076abbb009a77bb7d2e2aa3e043cf05d03a1773a8c4151bf2c6b9ee2ec1cde8c89e188c4d971bb8b50be3097aa245605acc4beda6bd03915

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe

Filesize
468KB

MD5
098c21c8a6cb064bd28dd656d9001f29

SHA1
890b759234955bb0acfbc85d8140391c9473a35e

SHA256
2a3de6377ab346fa782fbdeba983800cb477a35467458fcd82609426f5614bb9

SHA512
3b48288332f4e1d532b6294572beff6df99adacd00a610ae8127f915d1575f9c29c39c67792f7e5280eadbeaf8525c3b738587d04d5043804c5927239dd860be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50931.exe

Filesize
468KB

MD5
3ae25fd118bb44adabe7a4ba249b5140

SHA1
f8e3788374f4c70cda140f3ea7666f8e1a828b10

SHA256
9d2a59db5b5cdd8bbfd60e20a8518d3eef9ec5b68667e5a9dbf199e44abb525c

SHA512
3af02e087cceb893ecd49690e5f6970bc5b15e04d63eab312c4c82ef0be69c87add93db1d2f348e4a7dc718e2592b55585143f8634a49b2d66a9e89036db9649

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe

Filesize
468KB

MD5
4c6cb7602898e4de73ee25393a46b9b9

SHA1
798ab245ff1ef634afd70373b1eee15f095e6056

SHA256
1338412fc7e4951d77bf8dd9e8bd2df9dd04aacfd29ff8699f07b468f5f57129

SHA512
af5e6aea61dc5f03473147a423772e3f1e21e4f4596e55b90c24be081881989a2696cd9debaaed776c6b14e487a1d925a796b042836825f01ac7b7c9fab58450

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe

Filesize
468KB

MD5
52d824f06c366f0bdf954260b6ce58f7

SHA1
2922faf49ff81be52b38a1a6657e92510a497fde

SHA256
132a7871eb7afbb1ba5f97f9bbe4f6b40acbc73e7801271f110ce8a6007ea2b5

SHA512
f2672b985b942bb66ccb9c96060267683168722af88610cbd86b7b7f6ad06b1cce05c34f0f39dbf4132adaeba97849a3720a0ec160d10400e5e4be4e25d5f64f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe

Filesize
468KB

MD5
b0f879140b4f9f723b3e6426394f0771

SHA1
6b631f9dd834892323310d4622ba76162a2ef1c5

SHA256
a6741dca8b5afeef7dfc4a9f3bd82f9cb19a9531429fd2621beafdca409f1d91

SHA512
9b2abcaa69fdd56e5fca12509e98d4156fa549b9fb1a882db87f5ec32d64510bdbbaf7be09ad4f7f4d1650542c466ce6daacc120443f054d557db78dee046c5d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe

Filesize
468KB

MD5
517488efde1bd41ba7da82b9bfcf5bf1

SHA1
0399cd816435c6ab61e953455868633935070186

SHA256
a89d0467f265a58c947246bb29b8c151aff8591176345d268ccea089f14301e3

SHA512
4d57e391862e76d9de2e0bf6f5b526464a992705fb42d5b1964bdb5afcbde1368f8f4f92952109dbeb3f174f28bb068705f523d96ae65e73325bf7ce404339a5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe

Filesize
468KB

MD5
ce903e996b2a241f7b42b8bcd06583ce

SHA1
cfbdc74b55f7923e65ab424ec9616b422d62ce58

SHA256
f9688851b7585f99c06eac37e4d819fbea0fee7ca2b13a1be02656ad5185d81d

SHA512
ba853cb6522ee14e92509122ff3cbf83836c8914716e246321b3bc5f69109aab01ef8e8942efb0ca3493fb311b307a3097e4043739c8e21112204933bc07300d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe

Filesize
468KB

MD5
6a7d005a6f984c732914b67c8ca54227

SHA1
eae56597323d0b788f1cda90541a171bff11d7bb

SHA256
97b06611d4a1baa33bfdf8133c7beb5e509862f814a06c46a92df1f0da0171e9

SHA512
516094fc08784b4182890cc26cb6a2b95f3de8f98229be79d17a639bd019bcc934ecf478bc7d5a3b03c2516f00769ebb536527f1ddf597378fbabf5c83116cd1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe

Filesize
468KB

MD5
ef2149a5256472bc43c893ce9a87709f

SHA1
b7056ba3ce158ae5c9eea9f61dbbd3463de3fa74

SHA256
65c39c9a6b195fa120ad93c40357af32847fcba1d70be97838d02bb16ea1a12c

SHA512
4a59884f572f3f03e5d5a0fde6e4f07df3674ad7090f1bfb8a5272832ad5f6c84120e594345b1fe16fcf75638b0d098a5738f92999eaea3fccc35666b3d2c6f4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33982.exe

Filesize
468KB

MD5
14a0d1218e01027557ef8c29c388e583

SHA1
73ee21af5515822bc0aaf57f325e19aee4a2a8a6

SHA256
716aa3c766ad2a14252c7686913776a20feedf333f2da89d0309206377ce3314

SHA512
42d5e9067e515887d96df5c91d885d6ef9be347b64ef0abbcf8bb3df065336a28b1c95cb546fc2dfd673f398e2d30ec72a3eabed23c6da0c26d087ec68d23cd6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe

Filesize
468KB

MD5
b36d2d03c6f1c1454be5c78f3a7aa9c8

SHA1
6f2715a20486cd7ce13d4d2bdd3a7e83f605c483

SHA256
26474356147c4f177bce618244d72a0f58a43d9f3e04fd848aea9a99c35d276a

SHA512
53bc3e28c40dfd09cb584a383eed3b5515f5b43e850194bf03e6d5d6bcfda68084318b87e205148087ae08b7d3f22aadcfa818ed8791233b5caea45fdc6ab147

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42076.exe

Filesize
468KB

MD5
7d40a462671c5f604826059f1e4eaaf5

SHA1
793d58929497a6ee3b59503a750bc5397ac2bd61

SHA256
f16f84b92b69b6361904d373e3563a7ccc412c7e9bb28ad3383ddeefb13362b2

SHA512
c0075dbffc1243d5198e22691025bc878db10ac99e3fccd79ab0f88df7e90cf3fb7ea8254483b64874a0f3685a8325da5b02c908e33273a7874638ea8a8ea4ef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe

Filesize
468KB

MD5
d126feeb9e117348acd0e13ba0657244

SHA1
aee0725e65293c212de98cba793636f9d578cf4f

SHA256
04ed695e6927094bd12905c941301e836587bf271b65124a94cad105be24a1d2

SHA512
2cc9efa351e6a39da24c2ca17869af7c009d491e3920d18511841f3e7ed5650093fa96c4dac129f44fe3ec0e97e2055fdf860220ebdcd95a27abe38c1815a906

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44371.exe

Filesize
468KB

MD5
035332154b167b7935fabc2a22658a9b

SHA1
5b0c3f691ffdb965f663d81e89e283d649b826ca

SHA256
7392485f971b1c72349b397d0f339d3ee64aaf231e6b7b2ed3eda89a8a8acec9

SHA512
a27313cb1d1f88b5f63ec52357b1a92a5ad059d647e1ae12163db8da0015ae733542a06ad875c22484d105de38f15abb818ddf4ea19de55dec902de1a12329ac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe

Filesize
468KB

MD5
1f4bc6c6debbc324b4aa1a6994f8e7a5

SHA1
ea2cd203adde20a421746992c2a8e8dbd618c187

SHA256
efba7d62a61192c1090c29dc6506be9364000b45d97b5d796e9275b1fa862e2b

SHA512
c1319f9e6de6216e6c131b186dca942fde4f7fe9a33160bbbe6fe0abe7ff13d81c3fc9f6ab9b3c905101d26f49816badf78cc0caeab5029f2bf6b96b2b11a999

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe

Filesize
468KB

MD5
3fb8e8ac9faf60cb8bcbf93642142a41

SHA1
b8de0af6c8ebfb9d8855851e12a6451d9455cf14

SHA256
48bb084fb6f4da1f0f05bf37c5150ff5a853f22eb46fcf19e8758dddaf311b49

SHA512
ae0179c4be287cd26219eb9e6903cb3138b402ba8a1c226ed7a736f45d9c4497c1391d1ecb2669c94bdd70e83c1c7ccb9c40cf2d6fc32338ad188a46c123b07a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe

Filesize
468KB

MD5
a0b66416e2d826761f3d38a732be9159

SHA1
da7e65a784ac958e080c0877fd5eb57c97124e08

SHA256
0e5020be7e84a28bbeb0185c0dba7499be7b06fe5919248e64120e4604726884

SHA512
4bf499778cbe5601acf4732dacc79f8af3a49aba58a7f7c875368e7457a86fb67ff72db3ad563842a8bd720ec0ece4b66649c3fb62b273606ed4f8ad5c8cbecc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe

Filesize
468KB

MD5
7330a6e169a15d22dcc0a9a3ee7e705e

SHA1
34958112e141f3dd29ef239cf7fe9c9a26c83246

SHA256
90d353ce28127b4d1383f3b534a1678aafaf9815d182b9ec9c71fa09e77aa5d6

SHA512
1dd509f3028d49874c58514ee2e8a7f66d6f52ae8efc280eaed2ed5b78e515fd74dd417ff7fcde1e55d9ce4785ad13a55254c42003e43253a1d304d78fa3fdfa

Download Submit