850d1a8909917c271ca8253bec85ef127baf2ec71f33147cb9683506792e9096

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddbf86fb25fb18e563cbaf53cad94160N.exe
Size

468KB
MD5

ddbf86fb25fb18e563cbaf53cad94160
SHA1

c788263fcbbeb776a64217ac76e45fc6e12a7f38
SHA256

850d1a8909917c271ca8253bec85ef127baf2ec71f33147cb9683506792e9096
SHA512

b91c67c6f0c5e5329a3ebaf80e2e11ea78a0da19e4223aeede88879edc9e235fb9a27af006b8c42789f3ea5274b1a80a8aa767a9ec3f0bd648d7102722b20a84
SSDEEP

3072:ybCgoDcnI05UtbY+Pz+jcf8/VCMvCzupb6KHexVs0mfl8+ct7OAlQ:ybZoT8Ut5Pajcfp+EFmfabt7O

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1084	Unicorn-7763.exe
2332	Unicorn-53046.exe
2272	Unicorn-61769.exe
2744	Unicorn-37333.exe
2756	Unicorn-13383.exe
852	Unicorn-43455.exe
2944	Unicorn-49585.exe
784	Unicorn-26316.exe
1956	Unicorn-55843.exe
2268	Unicorn-56248.exe
1056	Unicorn-7047.exe
2500	Unicorn-6782.exe
2964	Unicorn-29505.exe
1964	Unicorn-35636.exe
1328	Unicorn-15770.exe
640	Unicorn-30914.exe
1444	Unicorn-36621.exe
2056	Unicorn-37027.exe
2188	Unicorn-34103.exe
2404	Unicorn-11069.exe
2232	Unicorn-6985.exe
2064	Unicorn-18972.exe
352	Unicorn-43742.exe
1368	Unicorn-23876.exe
2452	Unicorn-39658.exe
1576	Unicorn-64162.exe
1896	Unicorn-42980.exe
1764	Unicorn-27598.exe
2112	Unicorn-7732.exe
1752	Unicorn-29635.exe
584	Unicorn-40404.exe
2572	Unicorn-36233.exe
3016	Unicorn-58360.exe
884	Unicorn-8604.exe
988	Unicorn-31062.exe
1620	Unicorn-37193.exe
2768	Unicorn-62636.exe
2824	Unicorn-41469.exe
3024	Unicorn-28641.exe
2916	Unicorn-16123.exe
2776	Unicorn-607.exe
2888	Unicorn-40893.exe
2692	Unicorn-40323.exe
2292	Unicorn-21625.exe
1712	Unicorn-1396.exe
568	Unicorn-47068.exe
1632	Unicorn-55236.exe
1320	Unicorn-30539.exe
2432	Unicorn-50405.exe
2876	Unicorn-6942.exe
1064	Unicorn-29409.exe
2076	Unicorn-59350.exe
2936	Unicorn-498.exe
1944	Unicorn-8111.exe
1996	Unicorn-7846.exe
2620	Unicorn-1972.exe
2440	Unicorn-46020.exe
2060	Unicorn-34322.exe
1156	Unicorn-65479.exe
1836	Unicorn-34344.exe
376	Unicorn-14478.exe
544	Unicorn-46980.exe
1672	Unicorn-2418.exe
1492	Unicorn-62740.exe

Loads dropped DLL 64 IoCs

pid	Process
2380	ddbf86fb25fb18e563cbaf53cad94160N.exe
2380	ddbf86fb25fb18e563cbaf53cad94160N.exe
1084	Unicorn-7763.exe
2380	ddbf86fb25fb18e563cbaf53cad94160N.exe
1084	Unicorn-7763.exe
2380	ddbf86fb25fb18e563cbaf53cad94160N.exe
2332	Unicorn-53046.exe
2332	Unicorn-53046.exe
1084	Unicorn-7763.exe
1084	Unicorn-7763.exe
2380	ddbf86fb25fb18e563cbaf53cad94160N.exe
2272	Unicorn-61769.exe
2380	ddbf86fb25fb18e563cbaf53cad94160N.exe
2272	Unicorn-61769.exe
2744	Unicorn-37333.exe
2744	Unicorn-37333.exe
2332	Unicorn-53046.exe
2332	Unicorn-53046.exe
852	Unicorn-43455.exe
852	Unicorn-43455.exe
2380	ddbf86fb25fb18e563cbaf53cad94160N.exe
2944	Unicorn-49585.exe
2380	ddbf86fb25fb18e563cbaf53cad94160N.exe
2944	Unicorn-49585.exe
2272	Unicorn-61769.exe
1084	Unicorn-7763.exe
2756	Unicorn-13383.exe
2272	Unicorn-61769.exe
1084	Unicorn-7763.exe
2756	Unicorn-13383.exe
784	Unicorn-26316.exe
784	Unicorn-26316.exe
2744	Unicorn-37333.exe
2744	Unicorn-37333.exe
1956	Unicorn-55843.exe
1956	Unicorn-55843.exe
2332	Unicorn-53046.exe
2332	Unicorn-53046.exe
2964	Unicorn-29505.exe
2964	Unicorn-29505.exe
1964	Unicorn-35636.exe
1964	Unicorn-35636.exe
1084	Unicorn-7763.exe
1084	Unicorn-7763.exe
2500	Unicorn-6782.exe
2500	Unicorn-6782.exe
2756	Unicorn-13383.exe
2756	Unicorn-13383.exe
2268	Unicorn-56248.exe
2268	Unicorn-56248.exe
1328	Unicorn-15770.exe
1328	Unicorn-15770.exe
2380	ddbf86fb25fb18e563cbaf53cad94160N.exe
2380	ddbf86fb25fb18e563cbaf53cad94160N.exe
1056	Unicorn-7047.exe
852	Unicorn-43455.exe
1056	Unicorn-7047.exe
852	Unicorn-43455.exe
2272	Unicorn-61769.exe
2272	Unicorn-61769.exe
2944	Unicorn-49585.exe
2944	Unicorn-49585.exe
640	Unicorn-30914.exe
640	Unicorn-30914.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3640	1064	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddbf86fb25fb18e563cbaf53cad94160N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24928.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2380	ddbf86fb25fb18e563cbaf53cad94160N.exe
1084	Unicorn-7763.exe
2332	Unicorn-53046.exe
2272	Unicorn-61769.exe
2744	Unicorn-37333.exe
2756	Unicorn-13383.exe
852	Unicorn-43455.exe
2944	Unicorn-49585.exe
784	Unicorn-26316.exe
1956	Unicorn-55843.exe
2268	Unicorn-56248.exe
1056	Unicorn-7047.exe
2964	Unicorn-29505.exe
1328	Unicorn-15770.exe
1964	Unicorn-35636.exe
2500	Unicorn-6782.exe
640	Unicorn-30914.exe
1444	Unicorn-36621.exe
2056	Unicorn-37027.exe
2188	Unicorn-34103.exe
2404	Unicorn-11069.exe
2232	Unicorn-6985.exe
2064	Unicorn-18972.exe
352	Unicorn-43742.exe
1368	Unicorn-23876.exe
2452	Unicorn-39658.exe
1576	Unicorn-64162.exe
1764	Unicorn-27598.exe
1896	Unicorn-42980.exe
2112	Unicorn-7732.exe
1752	Unicorn-29635.exe
584	Unicorn-40404.exe
2572	Unicorn-36233.exe
3016	Unicorn-58360.exe
884	Unicorn-8604.exe
988	Unicorn-31062.exe
1620	Unicorn-37193.exe
2824	Unicorn-41469.exe
2768	Unicorn-62636.exe
2916	Unicorn-16123.exe
3024	Unicorn-28641.exe
2776	Unicorn-607.exe
2888	Unicorn-40893.exe
2692	Unicorn-40323.exe
2292	Unicorn-21625.exe
1712	Unicorn-1396.exe
568	Unicorn-47068.exe
2432	Unicorn-50405.exe
1320	Unicorn-30539.exe
1632	Unicorn-55236.exe
2876	Unicorn-6942.exe
1064	Unicorn-29409.exe
1944	Unicorn-8111.exe
2076	Unicorn-59350.exe
2620	Unicorn-1972.exe
2936	Unicorn-498.exe
1996	Unicorn-7846.exe
2440	Unicorn-46020.exe
2060	Unicorn-34322.exe
1156	Unicorn-65479.exe
1836	Unicorn-34344.exe
376	Unicorn-14478.exe
544	Unicorn-46980.exe
1492	Unicorn-62740.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1084	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	29
PID 2380 wrote to memory of 1084	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	29
PID 2380 wrote to memory of 1084	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	29
PID 2380 wrote to memory of 1084	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	29
PID 1084 wrote to memory of 2332	1084	Unicorn-7763.exe	30
PID 1084 wrote to memory of 2332	1084	Unicorn-7763.exe	30
PID 1084 wrote to memory of 2332	1084	Unicorn-7763.exe	30
PID 1084 wrote to memory of 2332	1084	Unicorn-7763.exe	30
PID 2380 wrote to memory of 2272	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	31
PID 2380 wrote to memory of 2272	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	31
PID 2380 wrote to memory of 2272	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	31
PID 2380 wrote to memory of 2272	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	31
PID 2332 wrote to memory of 2744	2332	Unicorn-53046.exe	32
PID 2332 wrote to memory of 2744	2332	Unicorn-53046.exe	32
PID 2332 wrote to memory of 2744	2332	Unicorn-53046.exe	32
PID 2332 wrote to memory of 2744	2332	Unicorn-53046.exe	32
PID 1084 wrote to memory of 2756	1084	Unicorn-7763.exe	33
PID 1084 wrote to memory of 2756	1084	Unicorn-7763.exe	33
PID 1084 wrote to memory of 2756	1084	Unicorn-7763.exe	33
PID 1084 wrote to memory of 2756	1084	Unicorn-7763.exe	33
PID 2380 wrote to memory of 852	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	34
PID 2380 wrote to memory of 852	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	34
PID 2380 wrote to memory of 852	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	34
PID 2380 wrote to memory of 852	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	34
PID 2272 wrote to memory of 2944	2272	Unicorn-61769.exe	35
PID 2272 wrote to memory of 2944	2272	Unicorn-61769.exe	35
PID 2272 wrote to memory of 2944	2272	Unicorn-61769.exe	35
PID 2272 wrote to memory of 2944	2272	Unicorn-61769.exe	35
PID 2744 wrote to memory of 784	2744	Unicorn-37333.exe	36
PID 2744 wrote to memory of 784	2744	Unicorn-37333.exe	36
PID 2744 wrote to memory of 784	2744	Unicorn-37333.exe	36
PID 2744 wrote to memory of 784	2744	Unicorn-37333.exe	36
PID 2332 wrote to memory of 1956	2332	Unicorn-53046.exe	37
PID 2332 wrote to memory of 1956	2332	Unicorn-53046.exe	37
PID 2332 wrote to memory of 1956	2332	Unicorn-53046.exe	37
PID 2332 wrote to memory of 1956	2332	Unicorn-53046.exe	37
PID 852 wrote to memory of 2268	852	Unicorn-43455.exe	38
PID 852 wrote to memory of 2268	852	Unicorn-43455.exe	38
PID 852 wrote to memory of 2268	852	Unicorn-43455.exe	38
PID 852 wrote to memory of 2268	852	Unicorn-43455.exe	38
PID 2380 wrote to memory of 2500	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	39
PID 2380 wrote to memory of 2500	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	39
PID 2380 wrote to memory of 2500	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	39
PID 2380 wrote to memory of 2500	2380	ddbf86fb25fb18e563cbaf53cad94160N.exe	39
PID 2944 wrote to memory of 1056	2944	Unicorn-49585.exe	40
PID 2944 wrote to memory of 1056	2944	Unicorn-49585.exe	40
PID 2944 wrote to memory of 1056	2944	Unicorn-49585.exe	40
PID 2944 wrote to memory of 1056	2944	Unicorn-49585.exe	40
PID 2272 wrote to memory of 1328	2272	Unicorn-61769.exe	41
PID 2272 wrote to memory of 1328	2272	Unicorn-61769.exe	41
PID 2272 wrote to memory of 1328	2272	Unicorn-61769.exe	41
PID 2272 wrote to memory of 1328	2272	Unicorn-61769.exe	41
PID 1084 wrote to memory of 2964	1084	Unicorn-7763.exe	42
PID 1084 wrote to memory of 2964	1084	Unicorn-7763.exe	42
PID 1084 wrote to memory of 2964	1084	Unicorn-7763.exe	42
PID 1084 wrote to memory of 2964	1084	Unicorn-7763.exe	42
PID 2756 wrote to memory of 1964	2756	Unicorn-13383.exe	43
PID 2756 wrote to memory of 1964	2756	Unicorn-13383.exe	43
PID 2756 wrote to memory of 1964	2756	Unicorn-13383.exe	43
PID 2756 wrote to memory of 1964	2756	Unicorn-13383.exe	43
PID 784 wrote to memory of 640	784	Unicorn-26316.exe	44
PID 784 wrote to memory of 640	784	Unicorn-26316.exe	44
PID 784 wrote to memory of 640	784	Unicorn-26316.exe	44
PID 784 wrote to memory of 640	784	Unicorn-26316.exe	44

C:\Users\Admin\AppData\Local\Temp\ddbf86fb25fb18e563cbaf53cad94160N.exe
"C:\Users\Admin\AppData\Local\Temp\ddbf86fb25fb18e563cbaf53cad94160N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37333.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30914.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        9⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        9⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        9⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        9⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        9⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exe
        8⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        8⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14478.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46695.exe
        8⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46856.exe
        8⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        8⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        8⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exe
        7⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62740.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        8⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58235.exe
        8⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13726.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        7⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
        6⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        7⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        6⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29992.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50094.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46980.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        8⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55901.exe
        8⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        8⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        8⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10493.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        6⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11168.exe
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51929.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        7⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe
        6⤵
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        6⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31062.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25792.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42912.exe
        7⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        7⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
        6⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4099.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        5⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64939.exe
        6⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63312.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8121.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        5⤵
        
        PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25984.exe
        7⤵
        
        PID:112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        8⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56771.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37545.exe
        8⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27456.exe
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
        7⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7426.exe
        6⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51929.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
        6⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10737.exe
        6⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1993.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        6⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        5⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        6⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42742.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41469.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        6⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27074.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34168.exe
        8⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
        8⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        8⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
        7⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60928.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        7⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        7⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
        6⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        7⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        7⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        7⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
        6⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15064.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15128.exe
        5⤵
        
        PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        5⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63815.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31985.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29205.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        5⤵
        
        PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30504.exe
      4⤵
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64090.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15259.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15128.exe
      4⤵
      PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21625.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        7⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41184.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        8⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        8⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        8⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        7⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65070.exe
        6⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        7⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
        7⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
        6⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16545.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15314.exe
        6⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        7⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        5⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        5⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        6⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16655.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
        7⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        6⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64302.exe
        5⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11313.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6730.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4592.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        6⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15396.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13250.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13845.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        5⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29466.exe
      4⤵
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe
        5⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
        5⤵
        
        PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63312.exe
      4⤵
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15128.exe
      4⤵
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28641.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        6⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28343.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        7⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exe
        5⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22181.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56102.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51136.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25984.exe
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45735.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27456.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50284.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
        5⤵
        
        PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24794.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28260.exe
      4⤵
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52537.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
      4⤵
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14385.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
      4⤵
      PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39529.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-689.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exe
        6⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe
      4⤵
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29316.exe
        5⤵
        
        PID:604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29095.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
      4⤵
      PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62857.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50094.exe
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53820.exe
      4⤵
      PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
      4⤵
      PID:6836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
    3⤵
    PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8497.exe
    3⤵
    PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
    3⤵
    PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19328.exe
    3⤵
    PID:5888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7047.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        6⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17723.exe
        7⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47540.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe
        7⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29272.exe
        6⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        6⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15064.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34168.exe
        6⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
        7⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        6⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10933.exe
        5⤵
        
        PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        5⤵
        
        PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40404.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18033.exe
        5⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11313.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16296.exe
        7⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        7⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21318.exe
        6⤵
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46299.exe
        5⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        6⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55579.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62014.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25267.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18635.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        5⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
      4⤵
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63312.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8121.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
      4⤵
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
      4⤵
      PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
      4⤵
      PID:7004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64162.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1396.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45605.exe
        6⤵
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51929.exe
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        5⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10587.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30402.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25132.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        5⤵
        
        PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30539.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
        5⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27456.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
      4⤵
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59113.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
      4⤵
      PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49881.exe
        5⤵
        
        PID:2984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 232
        5⤵
        Program crash
        
        PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
      4⤵
      PID:780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
      4⤵
      PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exe
      4⤵
      PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
      4⤵
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
      4⤵
      PID:2512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
    3⤵
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
    3⤵
    PID:4776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15128.exe
    3⤵
    PID:6244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8111.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        6⤵
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        6⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        5⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9615.exe
        6⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23704.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        5⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64515.exe
        5⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54412.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31763.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64992.exe
      4⤵
      PID:908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13845.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
      4⤵
      PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
      4⤵
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        5⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
      4⤵
      PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
      4⤵
      PID:6204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34168.exe
      4⤵
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
      4⤵
      PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64066.exe
    3⤵
    PID:4244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
    3⤵
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
    3⤵
    PID:5288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48454.exe
        5⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9117.exe
        6⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17529.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56985.exe
      4⤵
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
        5⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39738.exe
      4⤵
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
      4⤵
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11168.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
      4⤵
      PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
      4⤵
      PID:6804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
    3⤵
    PID:2476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
    3⤵
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15064.exe
    3⤵
    PID:4672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
    3⤵
    PID:5364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
    3⤵
    PID:6388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42980.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42980.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46887.exe
      4⤵
      PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
      4⤵
      PID:6596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13979.exe
    3⤵
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23395.exe
    3⤵
    PID:4444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
    3⤵
    PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
    3⤵
    PID:6404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63799.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
    3⤵
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23341.exe
    3⤵
    PID:5156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41464.exe
    3⤵
    PID:6508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62799.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62799.exe
  2⤵
  PID:3008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
  2⤵
  PID:3812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
  2⤵
  PID:4168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58077.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58077.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
  2⤵
  PID:6052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe

Filesize
468KB

MD5
338a99ee7449bc5278a8ea17ff560f92

SHA1
15169b2bb7d41ac832c91d040e80460237c2ac94

SHA256
1a08aad0a3979fef93cb8a5cec7ad13ab0fb4619d0882db285d14010ea8434f6

SHA512
22d8a724e737b8291a9dc0be03c326e96610242bb723bb4146fb380fe82438cb7434c434389d7e462cd91b7aadf8091f21070cc5f5cb165c93a0175c5741b0ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe

Filesize
468KB

MD5
df8c316d41c2a174946951237b504adf

SHA1
56789a2b6c5182a138e53d691023bf4447170b7f

SHA256
03c31718ee21c4602110d746b4b91e0d5bcbfa05ab2ac40c9dc855170add5b85

SHA512
a40bdfdef35f72fa93372dcec5b10fa17b1c0aaf996e705da5e69ec419df0278a929824b5cce66cc2aff568a0747bf313e768f54bdf191c4e9f2d59026e9beb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe

Filesize
468KB

MD5
e87b8eb66f9370bd7f7519e36eab737f

SHA1
ee7060bcfb6c965a1d5acceafffeaf43d87976ad

SHA256
f127de9931ebd7f79e0c36d688f033f823d46f4a853b4be2435632e9a2712566

SHA512
f56150fb23d2c1cdd75e60df3608a23b7647e668eac9de2d82ee87a6db540d1589ec5096cbef8ab72c42f5d05cfd39202897fd9414e6c0776bbb400178a53a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe

Filesize
468KB

MD5
e4cb545d1a9a8e56f7d00ef1b1ea85d6

SHA1
2600d3066cadccec5467fb0659b5fc5bd58fcd14

SHA256
77b461a95b7b5c30b53b85093c8b215e9e1a6b720020a66c6865529fb6f1e5d7

SHA512
b97a5fdc19ea033749e8184392e607fc800252df2aa05f8bdf2f321f94d402e30f360322f656072b2dd85751de3f78c874558dc3f7221b0b49c03bcf2145b7cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe

Filesize
468KB

MD5
fcc9b17f566ceaa31bf96f3245db6ab8

SHA1
6feaa63103c5bc4ec81a6ef09f27d4c44a57e461

SHA256
f3e64f29a58dad508c991bbe13058774a5361fda92c4b5514b71a1d537a79ddf

SHA512
8d5e864c649c59ff56e91ad4556e6731f101c9b438e4cbbf0d4542539d93fe17206812ac2314fc77af85c73add3c95b53985330814afcb28de35d07be3857156

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe

Filesize
468KB

MD5
18280699c37b8b4c40c0de944d0b8329

SHA1
1b361468a89d37198a71540dfeb515ad732a112c

SHA256
f8ac65171cd8d01d382a94ff17a5bb84a699e3c4c02da4910101300919f17bcf

SHA512
b143f5843e6f6a8d20784673c5ba2014d2e841250afafcc49d856d0c770c9aa1af886f82fc0e4c2ebf6029d4b055da320da44503076a6ba362d21934694fa38f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7047.exe

Filesize
468KB

MD5
8f34bd80fef58eba41e29d0ed4a43af0

SHA1
d29fa15a527339d34d2ef59da2715ae57c467fa0

SHA256
83b66a87fdd93493954ba85599c5bb0505287219d70b46f1f90470539350827e

SHA512
850f4a3f0800f5f8ce3f8b5c2d921254c8d765c6eab81dbcb197f22d3950c0468e3e74ea611a035613b3a297edda75345a74b31a7ca5668e9f7cd729447973c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe

Filesize
468KB

MD5
3b8a9067b6f7e8f4da1ee9109bf8888c

SHA1
7c3b6a70174aad4ea034e1b3c2218a9058dd1dc3

SHA256
d9a2e3a1106d6d52dec51eb1b0047932744788b29bba015b2b15b52b468f41c0

SHA512
666d9456572d7c8fa8db1f7aeb6d73b25e1c382c59a6ea495288f340cb13939896a3b04daf642d29c09889dbc2c9ae5a7bfd6695de1b8c26dfd925820f44c6b9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30914.exe

Filesize
468KB

MD5
92e191fc06c44fda0a7f5a00ab6aba0b

SHA1
9aca4d220bdb9874a22542fcf2b5ad31ddc895a7

SHA256
f7e2dcfcfa80955d4d82f698874a22707b05985ac2a1dbbd5845daf01655010a

SHA512
5a6a2427dc282533bc7c7b31ac68a182f632ca5fcd2862065f24b3066417b786edc2d02c47e60776fd6424bccfc9aae6fb8cb3f45acb676f01ce2c67b50286d1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe

Filesize
468KB

MD5
bed93de01475e32628df833f4c2e9538

SHA1
b1cc07212e9d51ea64bb2c796cc5e0bb40fe0e67

SHA256
1f259af0468147dc6bf8a3f77bafc909cde9b00a61938d2b8b5f3039d9bc1e30

SHA512
d497f352632379d10ff03d5ec7159473d372f4b8f472bee673f3fed9af225113bb3f0c063c11b2db9e0151dcf1f4aff9be741bb13157513f5f4ff6004c5dfea6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe

Filesize
468KB

MD5
742602154e614d10e76ed17b3e0ad736

SHA1
7735b7990023304afd4bc1f5eb8e74e2c86ed6fa

SHA256
17af8c3edb4e339c7c6242e101d739b3023cc16578dc7b00e2aec2b345447d40

SHA512
f0434e09d3c7ed24204eb7f35b6cd1da4becd640a0acc695636cf5d9c3259f1c549396d7afa1e75b56549d4179a82d4eaae22c63a96d136db4fc5b1bac408dda

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe

Filesize
468KB

MD5
c49eb20485def15314b5a6c3d74068c6

SHA1
99c88f69b7980982cbe372aa5c559347c6ed1d6d

SHA256
5de797bab208a070c0346074d5efec0dea9012c844e7ec12498f20a1faaf0207

SHA512
7a7d9596108e81c50f2f4c7911de656824d10b45430020155863abc92ac987cb69cc1dd040cedda623b1e5ae20698798c42312109a530a36ca56366cdac7fcf8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37333.exe

Filesize
468KB

MD5
77fa9871de708a381dd7ff6a1c2459c7

SHA1
91f5f547f9df64e4d042a9d8555d4dac690f8002

SHA256
54c58ed1efbbdce4c89d901fd5b296e77fbb47e74b92bd72ed2923d7ac8f0abd

SHA512
cb768e9f54fec1af8e61ce58d223702f1214289573039997684b5055706f58da84a163be6cb576556d4624fa0d248b915bed2c8c537a7049affc5e3ed4e83c08

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe

Filesize
468KB

MD5
62873ba7b89a2160090e87b5e17030c2

SHA1
37d728d0f4df9e280d22bfb5c5cee305c4aaed11

SHA256
6ecaa5af3b309d1c905fdebf183528d605d753327d32ac7ce13ed51c5ca0641a

SHA512
a28b292e2d1b3324570a04ecc1bc750ce3b515bb29b406e94079b719a1138c04a39afb0fc03c0e1b6f78fef9a4d61a0ad1e78eb50d04bfd859dafd545d0258ce

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe

Filesize
468KB

MD5
54b787a0e79ceb70ed255daf705503ba

SHA1
f4b5000fc47ac06fa3ae97c7b8254f718d10961a

SHA256
bae15fa0837fda409129e05feccd82aa3cfed5652be40e688b070635929f9d03

SHA512
becab0685c719d7a04ede17484db966bf5e6b022f6cabf0a9248b0175a2951fd9b8edffb0c0274478cdb2502ef030b8d7f3f5b4d063099895efd7575b67104e5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe

Filesize
468KB

MD5
0a9f7e23db6b5d60b7a1858a12179c45

SHA1
4bfa2c5fa7d295f929e0012a8ab9187b2eb572aa

SHA256
76aa38c6c54e5239384b7c8bfdb48b2c245947803c2570d8f061dde79dd1737b

SHA512
e0f27a93a0d7296b7602b605b0caba10601c71a3408d8148935b968757208f82424f7a4ac171a87778682e79bea26c2f63e9d4467929e24c9b02cbed39daec4b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe

Filesize
468KB

MD5
f4c468342b9e4dda3c72f3d8b6faabdb

SHA1
68f1c959355b99b427af6129907ecbc0aa6a8b7e

SHA256
5ffa4750f48c91c1c9877e33dbb6db3836aed1e4bb9a58cc00e4db644ccac4f5

SHA512
d0a49262ff0b24de855a18244b0dba70be8a9cba0c7cb7936df970ce6ac74fbe58e62d35138e6a727d03f201a9d9c26df5497d94a6323096de2fbef9ee9ea7ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe

Filesize
468KB

MD5
1d21ba89b2f4d2392128342083e61ae8

SHA1
3aa4c8c97868eaa33498a21d273ac8e1e9974946

SHA256
d4ed484839a8dccdf9a837059af778a357b249159afbd9748852efc3e1a47557

SHA512
60df0f45cc5eeff5f80d2fefe93ab740b125bf19bc495c6bcfd7ac72cdddfa930ba40dc4b1747a3dcfe5b9d95ecb21367d974e8d1f639675f8f9f582db03e875

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe

Filesize
468KB

MD5
2cd8004a3a9216a1a6892b34a578caee

SHA1
363ea1c459a19fc27c90a50917e43ace8eae6809

SHA256
8c8dca815f36f937f4aae52f63b5df360cabd6733cafb3483936ff5eb5369ab9

SHA512
47338effc0443dca8c285df5eb24fcd414431a4e02f9c291aeedee02d8c3e677e156f7e857acf049135b8ad3ee209012a1222e746d43257a3e521ea2ec519be2

Download Submit