67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6e

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
Size

468KB
MD5

c7a58eb3b25bc2d7f0b2b3ae183d0cd0
SHA1

2d6f5f4d75c28aef9b602bdc86666a23942d846c
SHA256

67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6e
SHA512

b874f973fb0af257c04b074b220a1e0cd277587104d3a00857e1a5ae05990fade645466c664667613975d0da2ecfec0226f3fe57b87f362a4e40d56c8942e6e6
SSDEEP

3072:4geKogIaIU57tbYEPzc3bfD/E2DnsIH9QmyeQVssN5koaYmuzTlV:4groDc7t7P43bfya7uN5F/muz

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1824	Unicorn-28997.exe
2080	Unicorn-34076.exe
2884	Unicorn-35764.exe
2868	Unicorn-28756.exe
2776	Unicorn-1140.exe
2644	Unicorn-5587.exe
2624	Unicorn-25453.exe
2184	Unicorn-35468.exe
2680	Unicorn-57806.exe
1104	Unicorn-4884.exe
1652	Unicorn-57614.exe
2940	Unicorn-821.exe
1080	Unicorn-57236.exe
1220	Unicorn-46301.exe
1720	Unicorn-629.exe
2180	Unicorn-60036.exe
1360	Unicorn-47303.exe
2592	Unicorn-62487.exe
1144	Unicorn-15900.exe
1440	Unicorn-43197.exe
644	Unicorn-21839.exe
3016	Unicorn-62871.exe
1880	Unicorn-43005.exe
2060	Unicorn-40479.exe
888	Unicorn-40479.exe
1844	Unicorn-31854.exe
2560	Unicorn-20421.exe
2372	Unicorn-34156.exe
544	Unicorn-40287.exe
2232	Unicorn-16167.exe
564	Unicorn-61838.exe
1308	Unicorn-23565.exe
1432	Unicorn-65149.exe
3044	Unicorn-20779.exe
1536	Unicorn-57365.exe
2092	Unicorn-4827.exe
2336	Unicorn-38829.exe
2928	Unicorn-23167.exe
2772	Unicorn-16333.exe
2608	Unicorn-23269.exe
2724	Unicorn-29784.exe
2612	Unicorn-13447.exe
2908	Unicorn-55558.exe
1304	Unicorn-58159.exe
2712	Unicorn-44968.exe
780	Unicorn-44968.exe
316	Unicorn-44968.exe
532	Unicorn-9150.exe
1856	Unicorn-17318.exe
1992	Unicorn-45352.exe
968	Unicorn-45352.exe
2968	Unicorn-54870.exe
2476	Unicorn-63800.exe
1956	Unicorn-57670.exe
1640	Unicorn-27982.exe
2228	Unicorn-38803.exe
2072	Unicorn-21926.exe
428	Unicorn-22192.exe
1976	Unicorn-12954.exe
1372	Unicorn-29059.exe
1716	Unicorn-37459.exe
848	Unicorn-31328.exe
2504	Unicorn-26337.exe
1232	Unicorn-6130.exe

Loads dropped DLL 64 IoCs

pid	Process
1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
2108	WerFault.exe
2108	WerFault.exe
2108	WerFault.exe
2108	WerFault.exe
2108	WerFault.exe
2108	WerFault.exe
2108	WerFault.exe
2080	Unicorn-34076.exe
2080	Unicorn-34076.exe
1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
2884	Unicorn-35764.exe
2884	Unicorn-35764.exe
2080	Unicorn-34076.exe
2868	Unicorn-28756.exe
2080	Unicorn-34076.exe
2868	Unicorn-28756.exe
1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
2624	Unicorn-25453.exe
2624	Unicorn-25453.exe
2868	Unicorn-28756.exe
2868	Unicorn-28756.exe
2644	Unicorn-5587.exe
2644	Unicorn-5587.exe
2776	Unicorn-1140.exe
2776	Unicorn-1140.exe
1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
2884	Unicorn-35764.exe
1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
2884	Unicorn-35764.exe
2080	Unicorn-34076.exe
2184	Unicorn-35468.exe
2184	Unicorn-35468.exe
2080	Unicorn-34076.exe
1104	Unicorn-4884.exe
1104	Unicorn-4884.exe
2680	Unicorn-57806.exe
2680	Unicorn-57806.exe
2868	Unicorn-28756.exe
2868	Unicorn-28756.exe
2624	Unicorn-25453.exe
2624	Unicorn-25453.exe
1720	Unicorn-629.exe
1720	Unicorn-629.exe
2180	Unicorn-60036.exe
2184	Unicorn-35468.exe
2180	Unicorn-60036.exe
2184	Unicorn-35468.exe
2080	Unicorn-34076.exe
1220	Unicorn-46301.exe
1652	Unicorn-57614.exe
2080	Unicorn-34076.exe
1652	Unicorn-57614.exe
1220	Unicorn-46301.exe
2644	Unicorn-5587.exe
2644	Unicorn-5587.exe
2884	Unicorn-35764.exe
2884	Unicorn-35764.exe
2940	Unicorn-821.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2108	1824	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3048.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
1824	Unicorn-28997.exe
2080	Unicorn-34076.exe
2884	Unicorn-35764.exe
2868	Unicorn-28756.exe
2776	Unicorn-1140.exe
2644	Unicorn-5587.exe
2624	Unicorn-25453.exe
2184	Unicorn-35468.exe
2680	Unicorn-57806.exe
1104	Unicorn-4884.exe
1220	Unicorn-46301.exe
2940	Unicorn-821.exe
1652	Unicorn-57614.exe
1720	Unicorn-629.exe
1080	Unicorn-57236.exe
2180	Unicorn-60036.exe
1360	Unicorn-47303.exe
2592	Unicorn-62487.exe
1144	Unicorn-15900.exe
1440	Unicorn-43197.exe
644	Unicorn-21839.exe
1880	Unicorn-43005.exe
3016	Unicorn-62871.exe
2060	Unicorn-40479.exe
1844	Unicorn-31854.exe
888	Unicorn-40479.exe
544	Unicorn-40287.exe
2560	Unicorn-20421.exe
2372	Unicorn-34156.exe
2232	Unicorn-16167.exe
564	Unicorn-61838.exe
1308	Unicorn-23565.exe
1432	Unicorn-65149.exe
3044	Unicorn-20779.exe
1536	Unicorn-57365.exe
2092	Unicorn-4827.exe
2336	Unicorn-38829.exe
2772	Unicorn-16333.exe
2928	Unicorn-23167.exe
2608	Unicorn-23269.exe
2724	Unicorn-29784.exe
2612	Unicorn-13447.exe
780	Unicorn-44968.exe
2908	Unicorn-55558.exe
1304	Unicorn-58159.exe
316	Unicorn-44968.exe
2712	Unicorn-44968.exe
532	Unicorn-9150.exe
1992	Unicorn-45352.exe
1856	Unicorn-17318.exe
968	Unicorn-45352.exe
2476	Unicorn-63800.exe
1956	Unicorn-57670.exe
2968	Unicorn-54870.exe
1640	Unicorn-27982.exe
2228	Unicorn-38803.exe
2072	Unicorn-21926.exe
428	Unicorn-22192.exe
1976	Unicorn-12954.exe
1372	Unicorn-29059.exe
1716	Unicorn-37459.exe
848	Unicorn-31328.exe
2504	Unicorn-26337.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1824	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	30
PID 1732 wrote to memory of 1824	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	30
PID 1732 wrote to memory of 1824	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	30
PID 1732 wrote to memory of 1824	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	30
PID 1824 wrote to memory of 2108	1824	Unicorn-28997.exe	31
PID 1824 wrote to memory of 2108	1824	Unicorn-28997.exe	31
PID 1824 wrote to memory of 2108	1824	Unicorn-28997.exe	31
PID 1824 wrote to memory of 2108	1824	Unicorn-28997.exe	31
PID 1732 wrote to memory of 2080	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	32
PID 1732 wrote to memory of 2080	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	32
PID 1732 wrote to memory of 2080	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	32
PID 1732 wrote to memory of 2080	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	32
PID 2080 wrote to memory of 2884	2080	Unicorn-34076.exe	33
PID 2080 wrote to memory of 2884	2080	Unicorn-34076.exe	33
PID 2080 wrote to memory of 2884	2080	Unicorn-34076.exe	33
PID 2080 wrote to memory of 2884	2080	Unicorn-34076.exe	33
PID 1732 wrote to memory of 2868	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	34
PID 1732 wrote to memory of 2868	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	34
PID 1732 wrote to memory of 2868	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	34
PID 1732 wrote to memory of 2868	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	34
PID 2884 wrote to memory of 2776	2884	Unicorn-35764.exe	36
PID 2884 wrote to memory of 2776	2884	Unicorn-35764.exe	36
PID 2884 wrote to memory of 2776	2884	Unicorn-35764.exe	36
PID 2884 wrote to memory of 2776	2884	Unicorn-35764.exe	36
PID 2080 wrote to memory of 2644	2080	Unicorn-34076.exe	38
PID 2080 wrote to memory of 2644	2080	Unicorn-34076.exe	38
PID 2080 wrote to memory of 2644	2080	Unicorn-34076.exe	38
PID 2080 wrote to memory of 2644	2080	Unicorn-34076.exe	38
PID 2868 wrote to memory of 2624	2868	Unicorn-28756.exe	37
PID 2868 wrote to memory of 2624	2868	Unicorn-28756.exe	37
PID 2868 wrote to memory of 2624	2868	Unicorn-28756.exe	37
PID 2868 wrote to memory of 2624	2868	Unicorn-28756.exe	37
PID 1732 wrote to memory of 2184	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	39
PID 1732 wrote to memory of 2184	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	39
PID 1732 wrote to memory of 2184	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	39
PID 1732 wrote to memory of 2184	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	39
PID 2624 wrote to memory of 2680	2624	Unicorn-25453.exe	40
PID 2624 wrote to memory of 2680	2624	Unicorn-25453.exe	40
PID 2624 wrote to memory of 2680	2624	Unicorn-25453.exe	40
PID 2624 wrote to memory of 2680	2624	Unicorn-25453.exe	40
PID 2868 wrote to memory of 1104	2868	Unicorn-28756.exe	41
PID 2868 wrote to memory of 1104	2868	Unicorn-28756.exe	41
PID 2868 wrote to memory of 1104	2868	Unicorn-28756.exe	41
PID 2868 wrote to memory of 1104	2868	Unicorn-28756.exe	41
PID 2644 wrote to memory of 1652	2644	Unicorn-5587.exe	42
PID 2644 wrote to memory of 1652	2644	Unicorn-5587.exe	42
PID 2644 wrote to memory of 1652	2644	Unicorn-5587.exe	42
PID 2644 wrote to memory of 1652	2644	Unicorn-5587.exe	42
PID 2776 wrote to memory of 2940	2776	Unicorn-1140.exe	43
PID 2776 wrote to memory of 2940	2776	Unicorn-1140.exe	43
PID 2776 wrote to memory of 2940	2776	Unicorn-1140.exe	43
PID 2776 wrote to memory of 2940	2776	Unicorn-1140.exe	43
PID 1732 wrote to memory of 1080	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	44
PID 1732 wrote to memory of 1080	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	44
PID 1732 wrote to memory of 1080	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	44
PID 1732 wrote to memory of 1080	1732	67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe	44
PID 2884 wrote to memory of 1220	2884	Unicorn-35764.exe	45
PID 2884 wrote to memory of 1220	2884	Unicorn-35764.exe	45
PID 2884 wrote to memory of 1220	2884	Unicorn-35764.exe	45
PID 2884 wrote to memory of 1220	2884	Unicorn-35764.exe	45
PID 2184 wrote to memory of 1720	2184	Unicorn-35468.exe	47
PID 2184 wrote to memory of 1720	2184	Unicorn-35468.exe	47
PID 2184 wrote to memory of 1720	2184	Unicorn-35468.exe	47
PID 2184 wrote to memory of 1720	2184	Unicorn-35468.exe	47

C:\Users\Admin\AppData\Local\Temp\67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe
"C:\Users\Admin\AppData\Local\Temp\67cda1080dcc774d744506c16b7e66b0b14d717c86b75b0ccea8b50629882f6eN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 240
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37459.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        8⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        9⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        9⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        8⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17285.exe
        8⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        8⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8377.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23151.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26337.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        7⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        8⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        8⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57213.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20645.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        7⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        7⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        6⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
        7⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        8⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53095.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50894.exe
        6⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        6⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30520.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2620.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31328.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27776.exe
        6⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17147.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42757.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        5⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exe
        7⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23006.exe
        8⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64103.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
        7⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        6⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15138.exe
        7⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        7⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        6⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9150.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23120.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1870.exe
        7⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61357.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61277.exe
        6⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56209.exe
        6⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7158.exe
        5⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2030.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30520.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27316.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe
        6⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5778.exe
        7⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        6⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        7⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58862.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41926.exe
        5⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23151.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        5⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12723.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19596.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        6⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19522.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
      4⤵
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47494.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37741.exe
      4⤵
      PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        7⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        8⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        8⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        7⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16713.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        6⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
        7⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        7⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24478.exe
        5⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
        6⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
        6⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
        5⤵
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50727.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43076.exe
        5⤵
        
        PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        6⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        7⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55873.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        7⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28246.exe
        5⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        5⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        6⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61527.exe
      4⤵
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
      4⤵
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61250.exe
      4⤵
      PID:6384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60036.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        6⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        6⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50894.exe
        5⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
        5⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13454.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
      4⤵
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
      4⤵
      PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50727.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21208.exe
      4⤵
      PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        5⤵
        
        PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2269.exe
      4⤵
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28812.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29068.exe
      4⤵
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        5⤵
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24348.exe
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
    3⤵
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60436.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
      4⤵
      PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64560.exe
    3⤵
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe
    3⤵
    PID:6128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28756.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28756.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57806.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62487.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5445.exe
        7⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56196.exe
        8⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        8⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        8⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        8⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        7⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50190.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
        7⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56463.exe
        7⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        7⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        6⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        6⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4827.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        6⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        7⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
        5⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8746.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37741.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43197.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        6⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11536.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        6⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1293.exe
        6⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        6⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe
        5⤵
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60088.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        5⤵
        
        PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46129.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53224.exe
      4⤵
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        5⤵
        
        PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
      4⤵
      PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34887.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50727.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10788.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4884.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        6⤵
        Executes dropped EXE
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        7⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43140.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe
        6⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19046.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        7⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        7⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57680.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        6⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36508.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        5⤵
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63006.exe
        5⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
        6⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58862.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48598.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1685.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
        5⤵
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64852.exe
      4⤵
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe
        5⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22649.exe
      4⤵
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10115.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
      4⤵
      PID:6148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        5⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe
        5⤵
        
        PID:340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9853.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe
      4⤵
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23767.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
      4⤵
      PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
      4⤵
      PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
      4⤵
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62290.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22112.exe
      4⤵
      PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
      4⤵
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9075.exe
      4⤵
      PID:6984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
    3⤵
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62290.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61886.exe
        5⤵
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29223.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64103.exe
      4⤵
      PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
    3⤵
    PID:828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
      4⤵
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
      4⤵
      PID:6324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38445.exe
    3⤵
    PID:3976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1653.exe
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
    3⤵
    PID:5304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
    3⤵
    PID:7124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35468.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35468.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        6⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
        7⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17285.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
        5⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17243.exe
        5⤵
        
        PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        5⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15101.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57547.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
      4⤵
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1870.exe
        5⤵
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        5⤵
        
        PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1605.exe
      4⤵
      PID:524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58740.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43279.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
      4⤵
      PID:5912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29784.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17285.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
      4⤵
      PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57547.exe
      4⤵
      PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55558.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42029.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
      4⤵
      PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3063.exe
    3⤵
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55472.exe
      4⤵
      PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25002.exe
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52997.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
      4⤵
      PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
    3⤵
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8746.exe
    3⤵
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
    3⤵
    PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37741.exe
    3⤵
    PID:5764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9354.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26979.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65279.exe
      4⤵
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19513.exe
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
      4⤵
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
      4⤵
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
      4⤵
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57680.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
      4⤵
      PID:6264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
    3⤵
    PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
      4⤵
      PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61431.exe
      4⤵
      PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
      4⤵
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47039.exe
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
    3⤵
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23565.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23565.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
      4⤵
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        5⤵
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1340.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
      4⤵
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
      4⤵
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
      4⤵
      PID:6280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
    3⤵
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
      4⤵
      PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16881.exe
    3⤵
    PID:4492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57213.exe
    3⤵
    PID:5196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
    3⤵
    PID:5844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29059.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29059.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1870.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
    3⤵
    PID:6408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37476.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37476.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
  2⤵
  PID:3520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe
  2⤵
  PID:4596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55442.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55442.exe
  2⤵
  PID:5164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe

Filesize
468KB

MD5
55bb17de3e42b00d71831c50eaa3d3c8

SHA1
02a3a4a3e5b39ef338a0b9d0be59e96d66570be2

SHA256
cda60137ff6a9ba4768935728e631c1018aa910f79e4fc48b37aae5d88af6b81

SHA512
a0175c28b7edc1c26b26b3722d1e61a0558369facefb020e7e3cea64b6402ac9454c74d367c840419a97805188b6cf6bd4dd741c63536d8e6648ee0513c6b4cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe

Filesize
468KB

MD5
04ca80251980f08062304cdca7fd042a

SHA1
5523b67e3d1056974e45419e9e3b334b3183d78e

SHA256
69cd6e952eea51bb2f74a7364806a7eb9f48f3f52c0356e19a216135ec17f1cb

SHA512
fc0fc212d80ea3b646953622e4d67c30f1549a3bd3128965792e1cfcd9f4b34fe74c4da60c72ab03a07d1291dfd9a1bc0cac355f708e4ff16efd3bf86ca86658

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4884.exe

Filesize
468KB

MD5
6fa7e37d9206698cd7df5ce8c3cad0d8

SHA1
0200f0f46b4ca2cabbe9862178236e293773b02c

SHA256
9cefc85f5359ea54a9872789db87ded690e09aab73028974ac4a69c9e1d58eab

SHA512
386efa5b2df74102a13fe5dbe5f2df59cf293e3c0725be98c20d18e0cc854f37c57681fa9902a3ad5a65e089e9b51d66468ec5a6c03bd93dc18c622979ace8f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5445.exe

Filesize
468KB

MD5
aa9e986d96380b68f4e57df5d1334b94

SHA1
833c1f02e3d00db8593e14739a85ec22d6eb73be

SHA256
84e0209c71c0c1675c4a859c22060e218dd043fe23045d569fdf00a90910d132

SHA512
0c004a9ec2ec45236b0e0523477365f6ed20383f9cbd03d0aa024d2a3d31ffebb914849a12930cd1877565c1db4f08473f159f52b2a607a95bd8f03996dba21b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe

Filesize
468KB

MD5
a1b922d195ef752d610972755f01c3ff

SHA1
14b13b38ab0b271fedcd6c241cc98caad0b9f171

SHA256
7a4ef78028e156325b0300aab4924046f77efd2fa21b31091dfc15e5a91ce499

SHA512
f8ade7190ee1a08c669deee5d15a6635fb2a1d2d897edfc4b9392d30967c84704e8d9122e6e09b3978b793692c1e17d575fbc641c90f8455f6a16355edc464a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe

Filesize
468KB

MD5
9acd7179dbf51d19e7d3e5567a383341

SHA1
652a9a436bf68c897ae0dd7e1f4d2e036329d556

SHA256
b36d1b2df024cd7c931020e5bb5ff8a4ee61ae14f8c401d8b37bcb62dd5bdaa0

SHA512
32996c30dd1142986f9724681e5297ef71291a9377f708336ef0dd97aee6565afaaa27ce1b2fd63651fd64904c0f920b5c6142186b1c6c971ada802f45ce0276

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63006.exe

Filesize
468KB

MD5
88d7a7c2968b7a61da5497e94790c8a7

SHA1
fece85c46b85982e7489a8688e23e55aa74e1387

SHA256
b2e5ad2c2c1cb7c61be9bcf92d248f951b88fdcb5793b094136e6b62a0ecb1c2

SHA512
5266d400ff3b28bc02b21e4a4ffbc53a51efd7959d0ddb116a94d1e1a86c7331c14c6fc0f7baebade1d01e1e5cd5b30ad8e174b687171c757fa5015ebc713afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe

Filesize
468KB

MD5
c36b748dba6648e8faaeb3c501393486

SHA1
ac3296d3f3f62f0d9be5919d5431c80b0a3a057a

SHA256
7a370f37227a57ec75bfa6ffa9589edbdc2b89cb8d64870e721c2140ea8a5b90

SHA512
e1cf47dcba71cf3e352c7bcefea0dbc79dc189e25f606b0bd94eb0818226c6947e2a44dd1bfde13d15f990bc8382c0521a81ef192a9a8a3f99aab7d4b59896db

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe

Filesize
468KB

MD5
f40fe0bb037e4fe66beaaaa5e5bceb39

SHA1
ab74a656b95271457bfc53efbfacbdaccaa462d7

SHA256
7d307d776ace6b5d568f07d7a8dc4fd01967f791cda067fa04ccf9e5ab986960

SHA512
164ab9677e4d0965b3fc3732c006fab1bd86e78549ed525eddd8fb4db07506f6e3ada45158ec84d7f0860890ca3a30d3040cc594efef641958abf6a15a4ead62

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28756.exe

Filesize
468KB

MD5
38672325a0f684567b34067cca15e48d

SHA1
cefefa7c10454e509ea395833ea2ccd84e00e904

SHA256
3eb68085b415ffaa22cf8b6ecc64dadd8aff49f33047a7afc6a8b6e37f9fde9a

SHA512
320b7f18ebb90045a9f27a8635e038337a818e07e6f5ff4d369452eeca76ec5f1eec7dc7fde3a9039df8efdfacfda5729bcbdf6e0613c55a6032fba3cb844e1a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe

Filesize
468KB

MD5
aebf0f810a0bfa22cb69be46249f19a2

SHA1
10aa741245e9f008851e4911dea22353ccd6f59f

SHA256
a756697694d418fe0e887bcb08174e30c9ee138e1ea98d017bb6c351a440b2e5

SHA512
5706f1adbbc9bb98681db68b21397afe5285a77a98d02ecefcaa143991a630ec9d7347140fe2e1f8a22bb9b22cb2395206d1d8e4e72d9d481e4d0761f4f31133

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe

Filesize
468KB

MD5
dfe0e02d601f5e6313e47aa2f519c6d4

SHA1
fdd3a0efb6fecc2af0019287d14a61406ff9f2f9

SHA256
157e5b98846017a72aad2af3a08736fc0675c4164fda2572358371e69d0cf619

SHA512
fafc6beb20810a0825359e2de8fcb775a1a51758c8472ca81c8a4d37df6593192c1c94d87bb3396f943eb7ad6e1d0cec63cd59c8ee3d42a85ff706c032a574ad

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35468.exe

Filesize
468KB

MD5
579b4fe51e543962c96c6634786fba5d

SHA1
f76e13fc92f594b2e5e8acefe34a2175f01ae4c6

SHA256
6237a009ddf44d93e42e46e13e32cd85a186addfe11d3d4a2f34b16ef180ba7e

SHA512
0d2ff1be79e304574ce0cf61ddeac99271e3a1d44eba60f496beff603a454046ff354f4ded7eba7c9e520790d03ae182a6180312eb33eadebf67a8bdab0ab430

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe

Filesize
468KB

MD5
c976f44f7f9f496f651e97f5bef26846

SHA1
b08c03225abae4f0365d3163f094043d101f0a81

SHA256
88e0178c28a38f87f1fc6b163e1f0f09a8338a7b60a495acf15ab44ccf0b8c06

SHA512
61b1034ccff6210d369ea1296fa25bb05d170cc6d10502e36d8e0afab67907d19942cc87dd4dc97caf9d978fc1fb886cb7f76e9344bc78ed70f77f9ef629c9f7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe

Filesize
468KB

MD5
63171ff48b1d6c027f2440f85c2e77d9

SHA1
702814c7592ac7770144efd9d792fd48bd2e8355

SHA256
1719c0a03a1435bdc29ab9f75576a902b375d18ea72bbffc60dea0a3d20c8d07

SHA512
10998949a8155b4820afe161a663f9c9b9fd05ecbabb1a8ffdbb8b4ddce04705470cef68812fa5074022f3ae5785a42a7d605b3c8b3f3e8ad9d80276b62a5be0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe

Filesize
468KB

MD5
4c045a9af1be46dd530a9f4c0fd36a05

SHA1
1e9b49ce7211789d169cf68f990cdbda334cfc2a

SHA256
ff2d7f88c4aa7f470cfc66e79d6dc2683c2bd2da5a290fc5336c808a4c8650f7

SHA512
662b19046a60bdace2ee7517a7764842af46a1832680ff89cf830efe5dc83dd8310864ff45f0ce0b9233b96b4436d2a7ab39b8efa7cabd51157d3623ad9dc3fa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe

Filesize
468KB

MD5
21154890184eed3fa7fa4529bdaf365f

SHA1
0d1f17c181169017ffbe998d57f843ecbd16b17f

SHA256
dc79e2312fc819b4dd57cd23f7425e725aee395083d1da7cc7b188c8991f9265

SHA512
259475fc40c64973774e67f062432ee6c45267deaf34d300b6ee1363c3abbbbed41943afc2bc2052ff6116fe01203d722e826240a750c8342ad7612f2f7a235b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57806.exe

Filesize
468KB

MD5
e3c16f3074277b8d6bafb2c2c53d6a86

SHA1
e99a1ef7b600e0f94a901bbea271e8f770afd074

SHA256
81ecf58b40870d219fb0203923f5b09a097ab7845e1261f4339c9cfc771e06f4

SHA512
f3b5fc33adddb2f623fee0f09eab563c14e7e739e112af4c7e8594f21a1140d22a1e31224b873d9ccd45d129a4808e8b39026eb38e3eea80b66a9d7f4b2394fc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60036.exe

Filesize
468KB

MD5
54cb627a9d3961dc3fa83b37a19286f6

SHA1
a48f6937fe0b4c480920a45698115c2d7bfa00c9

SHA256
8a7e36d71728ace26a95e20a9d97f99e97744da5d67c841e372db38bdc4c4f15

SHA512
a187e40234733b1a178e07bc8b51c59d8868c3dbfb0cb08075a3d0e7bf64ae83ca8bff03c00e51357b10dfdd46733b9d296baef3fc750c8b12827d354dd3ed14

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-629.exe

Filesize
468KB

MD5
ef2eb0f0abc24f67b5a48ca495b6b87e

SHA1
fbaa91ef5d7f6b6122cdd02d69999e8d301b6fd6

SHA256
f2d28474e42d06c890d4887502db2a15b87e99d81b71deb136a6c9bc6561af6b

SHA512
145605264b1db1f1eb53cda3113b27fac29fcdc37f1ff33a01795102dce98eb85b3400bd4fffcb036d061cce437d29864275a7de56b21886e40ebac5919257be

Download Submit