836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7

Analysis

max time kernel
112s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
Size

468KB
MD5

bc24bfaa3ac03c4b36c0b3b5e02df520
SHA1

ab36acb86f077d4962bc657336f97d1bf9698fbb
SHA256

836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7
SHA512

f6c709b48dc47c0bb5c3d20e34846db2802eb66758720d680e077f61ee2e8266e8ee91a393de59f7f20192e1258d1985f8dcb837cda361a9e1d1d81abfd0f356
SSDEEP

3072:abAuorldI03YLbY2PzcIffT/ECXv4umpnsHCOVhxsyPaWSE7tWl1:abZoQOYLBP4IffmhVisyiZE7t

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2284	Unicorn-10736.exe
2328	Unicorn-56766.exe
2112	Unicorn-56211.exe
2780	Unicorn-65002.exe
2788	Unicorn-11717.exe
2824	Unicorn-57389.exe
2716	Unicorn-30283.exe
2624	Unicorn-13144.exe
2672	Unicorn-62900.exe
1688	Unicorn-9060.exe
1448	Unicorn-59008.exe
1432	Unicorn-13336.exe
2272	Unicorn-54872.exe
2352	Unicorn-55137.exe
1004	Unicorn-49007.exe
2652	Unicorn-29803.exe
1788	Unicorn-60098.exe
2232	Unicorn-10534.exe
780	Unicorn-43399.exe
1104	Unicorn-37269.exe
2300	Unicorn-43399.exe
1604	Unicorn-5112.exe
1796	Unicorn-59714.exe
1748	Unicorn-1790.exe
2504	Unicorn-30379.exe
968	Unicorn-16080.exe
1280	Unicorn-27041.exe
308	Unicorn-38739.exe
2456	Unicorn-10150.exe
2156	Unicorn-9885.exe
812	Unicorn-10705.exe
1744	Unicorn-35314.exe
1952	Unicorn-19532.exe
3008	Unicorn-19746.exe
1628	Unicorn-58924.exe
1240	Unicorn-7685.exe
604	Unicorn-8432.exe
2644	Unicorn-52802.exe
2204	Unicorn-65033.exe
2776	Unicorn-52226.exe
2740	Unicorn-10616.exe
2904	Unicorn-52418.exe
2172	Unicorn-58017.exe
2688	Unicorn-12345.exe
2820	Unicorn-12345.exe
552	Unicorn-33512.exe
652	Unicorn-8453.exe
1360	Unicorn-8453.exe
2984	Unicorn-54125.exe
1180	Unicorn-22935.exe
1712	Unicorn-29066.exe
1064	Unicorn-41053.exe
2000	Unicorn-39673.exe
1620	Unicorn-26443.exe
316	Unicorn-47768.exe
2864	Unicorn-48033.exe
2880	Unicorn-48033.exe
2996	Unicorn-51355.exe
2224	Unicorn-48993.exe
2132	Unicorn-29127.exe
2932	Unicorn-14274.exe
324	Unicorn-40825.exe
972	Unicorn-16875.exe
268	Unicorn-24297.exe

Loads dropped DLL 64 IoCs

pid	Process
2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
2284	Unicorn-10736.exe
2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
2284	Unicorn-10736.exe
2112	Unicorn-56211.exe
2112	Unicorn-56211.exe
2328	Unicorn-56766.exe
2328	Unicorn-56766.exe
2284	Unicorn-10736.exe
2284	Unicorn-10736.exe
2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
2780	Unicorn-65002.exe
2112	Unicorn-56211.exe
2780	Unicorn-65002.exe
2112	Unicorn-56211.exe
2788	Unicorn-11717.exe
2788	Unicorn-11717.exe
2328	Unicorn-56766.exe
2328	Unicorn-56766.exe
2824	Unicorn-57389.exe
2824	Unicorn-57389.exe
2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
2716	Unicorn-30283.exe
2284	Unicorn-10736.exe
2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
2284	Unicorn-10736.exe
2716	Unicorn-30283.exe
2624	Unicorn-13144.exe
2624	Unicorn-13144.exe
2780	Unicorn-65002.exe
2780	Unicorn-65002.exe
2672	Unicorn-62900.exe
2672	Unicorn-62900.exe
2112	Unicorn-56211.exe
2272	Unicorn-54872.exe
2352	Unicorn-55137.exe
2272	Unicorn-54872.exe
2112	Unicorn-56211.exe
2352	Unicorn-55137.exe
2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
2716	Unicorn-30283.exe
1448	Unicorn-59008.exe
2716	Unicorn-30283.exe
1448	Unicorn-59008.exe
1688	Unicorn-9060.exe
1688	Unicorn-9060.exe
2788	Unicorn-11717.exe
2328	Unicorn-56766.exe
2788	Unicorn-11717.exe
2328	Unicorn-56766.exe
1004	Unicorn-49007.exe
1004	Unicorn-49007.exe
2284	Unicorn-10736.exe
1432	Unicorn-13336.exe
2284	Unicorn-10736.exe
1432	Unicorn-13336.exe
2824	Unicorn-57389.exe
2824	Unicorn-57389.exe
2652	Unicorn-29803.exe
2652	Unicorn-29803.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
536	1712	WerFault.exe	81
5384	2920	WerFault.exe	423

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57429.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
2284	Unicorn-10736.exe
2112	Unicorn-56211.exe
2328	Unicorn-56766.exe
2780	Unicorn-65002.exe
2788	Unicorn-11717.exe
2824	Unicorn-57389.exe
2716	Unicorn-30283.exe
2624	Unicorn-13144.exe
2672	Unicorn-62900.exe
1688	Unicorn-9060.exe
2352	Unicorn-55137.exe
2272	Unicorn-54872.exe
1448	Unicorn-59008.exe
1004	Unicorn-49007.exe
1432	Unicorn-13336.exe
2652	Unicorn-29803.exe
1788	Unicorn-60098.exe
2232	Unicorn-10534.exe
780	Unicorn-43399.exe
2300	Unicorn-43399.exe
1104	Unicorn-37269.exe
1604	Unicorn-5112.exe
1748	Unicorn-1790.exe
1796	Unicorn-59714.exe
2504	Unicorn-30379.exe
2156	Unicorn-9885.exe
2456	Unicorn-10150.exe
308	Unicorn-38739.exe
968	Unicorn-16080.exe
812	Unicorn-10705.exe
1280	Unicorn-27041.exe
1744	Unicorn-35314.exe
1952	Unicorn-19532.exe
3008	Unicorn-19746.exe
1628	Unicorn-58924.exe
1240	Unicorn-7685.exe
604	Unicorn-8432.exe
2644	Unicorn-52802.exe
2776	Unicorn-52226.exe
2204	Unicorn-65033.exe
2740	Unicorn-10616.exe
2904	Unicorn-52418.exe
2688	Unicorn-12345.exe
2172	Unicorn-58017.exe
1360	Unicorn-8453.exe
2820	Unicorn-12345.exe
552	Unicorn-33512.exe
2984	Unicorn-54125.exe
652	Unicorn-8453.exe
1180	Unicorn-22935.exe
1712	Unicorn-29066.exe
1064	Unicorn-41053.exe
2000	Unicorn-39673.exe
1620	Unicorn-26443.exe
2880	Unicorn-48033.exe
316	Unicorn-47768.exe
2864	Unicorn-48033.exe
2996	Unicorn-51355.exe
2132	Unicorn-29127.exe
2932	Unicorn-14274.exe
2224	Unicorn-48993.exe
324	Unicorn-40825.exe
972	Unicorn-16875.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2284	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	31
PID 2972 wrote to memory of 2284	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	31
PID 2972 wrote to memory of 2284	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	31
PID 2972 wrote to memory of 2284	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	31
PID 2972 wrote to memory of 2328	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	32
PID 2972 wrote to memory of 2328	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	32
PID 2972 wrote to memory of 2328	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	32
PID 2972 wrote to memory of 2328	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	32
PID 2284 wrote to memory of 2112	2284	Unicorn-10736.exe	33
PID 2284 wrote to memory of 2112	2284	Unicorn-10736.exe	33
PID 2284 wrote to memory of 2112	2284	Unicorn-10736.exe	33
PID 2284 wrote to memory of 2112	2284	Unicorn-10736.exe	33
PID 2112 wrote to memory of 2780	2112	Unicorn-56211.exe	34
PID 2112 wrote to memory of 2780	2112	Unicorn-56211.exe	34
PID 2112 wrote to memory of 2780	2112	Unicorn-56211.exe	34
PID 2112 wrote to memory of 2780	2112	Unicorn-56211.exe	34
PID 2328 wrote to memory of 2788	2328	Unicorn-56766.exe	35
PID 2328 wrote to memory of 2788	2328	Unicorn-56766.exe	35
PID 2328 wrote to memory of 2788	2328	Unicorn-56766.exe	35
PID 2328 wrote to memory of 2788	2328	Unicorn-56766.exe	35
PID 2284 wrote to memory of 2824	2284	Unicorn-10736.exe	36
PID 2284 wrote to memory of 2824	2284	Unicorn-10736.exe	36
PID 2284 wrote to memory of 2824	2284	Unicorn-10736.exe	36
PID 2284 wrote to memory of 2824	2284	Unicorn-10736.exe	36
PID 2972 wrote to memory of 2716	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	37
PID 2972 wrote to memory of 2716	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	37
PID 2972 wrote to memory of 2716	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	37
PID 2972 wrote to memory of 2716	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	37
PID 2780 wrote to memory of 2624	2780	Unicorn-65002.exe	38
PID 2780 wrote to memory of 2624	2780	Unicorn-65002.exe	38
PID 2780 wrote to memory of 2624	2780	Unicorn-65002.exe	38
PID 2780 wrote to memory of 2624	2780	Unicorn-65002.exe	38
PID 2112 wrote to memory of 2672	2112	Unicorn-56211.exe	39
PID 2112 wrote to memory of 2672	2112	Unicorn-56211.exe	39
PID 2112 wrote to memory of 2672	2112	Unicorn-56211.exe	39
PID 2112 wrote to memory of 2672	2112	Unicorn-56211.exe	39
PID 2788 wrote to memory of 1688	2788	Unicorn-11717.exe	40
PID 2788 wrote to memory of 1688	2788	Unicorn-11717.exe	40
PID 2788 wrote to memory of 1688	2788	Unicorn-11717.exe	40
PID 2788 wrote to memory of 1688	2788	Unicorn-11717.exe	40
PID 2328 wrote to memory of 1448	2328	Unicorn-56766.exe	41
PID 2328 wrote to memory of 1448	2328	Unicorn-56766.exe	41
PID 2328 wrote to memory of 1448	2328	Unicorn-56766.exe	41
PID 2328 wrote to memory of 1448	2328	Unicorn-56766.exe	41
PID 2824 wrote to memory of 1432	2824	Unicorn-57389.exe	42
PID 2824 wrote to memory of 1432	2824	Unicorn-57389.exe	42
PID 2824 wrote to memory of 1432	2824	Unicorn-57389.exe	42
PID 2824 wrote to memory of 1432	2824	Unicorn-57389.exe	42
PID 2972 wrote to memory of 2272	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	43
PID 2972 wrote to memory of 2272	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	43
PID 2972 wrote to memory of 2272	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	43
PID 2972 wrote to memory of 2272	2972	836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe	43
PID 2284 wrote to memory of 1004	2284	Unicorn-10736.exe	45
PID 2284 wrote to memory of 1004	2284	Unicorn-10736.exe	45
PID 2284 wrote to memory of 1004	2284	Unicorn-10736.exe	45
PID 2284 wrote to memory of 1004	2284	Unicorn-10736.exe	45
PID 2716 wrote to memory of 2352	2716	Unicorn-30283.exe	44
PID 2716 wrote to memory of 2352	2716	Unicorn-30283.exe	44
PID 2716 wrote to memory of 2352	2716	Unicorn-30283.exe	44
PID 2716 wrote to memory of 2352	2716	Unicorn-30283.exe	44
PID 2624 wrote to memory of 2652	2624	Unicorn-13144.exe	46
PID 2624 wrote to memory of 2652	2624	Unicorn-13144.exe	46
PID 2624 wrote to memory of 2652	2624	Unicorn-13144.exe	46
PID 2624 wrote to memory of 2652	2624	Unicorn-13144.exe	46

C:\Users\Admin\AppData\Local\Temp\836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe
"C:\Users\Admin\AppData\Local\Temp\836d9d2c3e94f6ba87da6d92053023c932f94f54ab77f2e2e2de18163e3b0dd7N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56211.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24297.exe
        8⤵
        Executes dropped EXE
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        9⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
        10⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16286.exe
        10⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        9⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60422.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        9⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        9⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
        9⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        9⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        9⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        8⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-750.exe
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        8⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
        7⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38996.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47735.exe
        9⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40495.exe
        9⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        9⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        9⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23785.exe
        8⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        8⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
        8⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        8⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57562.exe
        7⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45177.exe
        8⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38628.exe
        7⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        7⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        9⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        8⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        8⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        8⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        7⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
        8⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        8⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61501.exe
        7⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        7⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65026.exe
        7⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47907.exe
        6⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        7⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        8⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        8⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60422.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        7⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 188
        8⤵
        Program crash
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        7⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        6⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37751.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35911.exe
        7⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        6⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41086.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12110.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60098.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45869.exe
        7⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27185.exe
        8⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55234.exe
        9⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        9⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47766.exe
        8⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
        8⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        8⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23982.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26996.exe
        7⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32276.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        7⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        7⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58924.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43298.exe
        6⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        7⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17298.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21593.exe
        7⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3988.exe
        6⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42032.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57926.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58022.exe
        5⤵
        
        PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62900.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45293.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        8⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        8⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe
        8⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25619.exe
        6⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        7⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16897.exe
        6⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        7⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        7⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
        6⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        6⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5613.exe
        5⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        6⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58072.exe
        5⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
        5⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        6⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        7⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60422.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63184.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51746.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47768.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        5⤵
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33625.exe
      4⤵
      PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8773.exe
      4⤵
      PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13336.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        8⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        8⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        8⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63946.exe
        8⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        7⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57558.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        7⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2431.exe
        6⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        7⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        6⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33210.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11723.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
        5⤵
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        6⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42712.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29066.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 244
        6⤵
        Program crash
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28642.exe
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45919.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        6⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8739.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29422.exe
        5⤵
        
        PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25881.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56891.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
      4⤵
      PID:6552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49007.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        6⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        7⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38439.exe
        7⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7257.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        7⤵
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3437.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33110.exe
        7⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43827.exe
        5⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        6⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33512.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        5⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35911.exe
        6⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47766.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25694.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        5⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        5⤵
        
        PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12886.exe
      4⤵
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        5⤵
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
      4⤵
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
        5⤵
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
      4⤵
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
      4⤵
      PID:6560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9885.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
      4⤵
      PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63334.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17570.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
      4⤵
      PID:5644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51355.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
      4⤵
      PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
      4⤵
      PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
    3⤵
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe
    3⤵
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
    3⤵
    PID:5164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11717.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30379.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        6⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-200.exe
        6⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16763.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        6⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exe
        5⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32276.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62805.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27041.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1523.exe
        6⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40173.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20523.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        5⤵
        
        PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        5⤵
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        5⤵
        
        PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        5⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        5⤵
        
        PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3837.exe
      4⤵
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        5⤵
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42376.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49807.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
      4⤵
      PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59008.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1790.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        6⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        5⤵
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52067.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21221.exe
        5⤵
        
        PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29127.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        5⤵
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe
        6⤵
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        6⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16080.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        5⤵
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42032.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        6⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
        5⤵
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        5⤵
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61834.exe
      4⤵
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
      4⤵
      PID:6424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
      4⤵
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16286.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        5⤵
        
        PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11724.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
    3⤵
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
      4⤵
      PID:6912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57926.exe
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53938.exe
    3⤵
    PID:4920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
    3⤵
    PID:5756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43399.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        6⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16286.exe
        7⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
        7⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        6⤵
        
        PID:276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        5⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30927.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        5⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
      4⤵
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        5⤵
        
        PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22894.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
      4⤵
      PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59714.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        5⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        6⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11724.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22145.exe
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44637.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        5⤵
        
        PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11724.exe
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17570.exe
      4⤵
      PID:400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
      4⤵
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe
      4⤵
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51866.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-750.exe
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
      4⤵
      PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
      4⤵
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16281.exe
    3⤵
    PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
      4⤵
      PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62275.exe
      4⤵
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49407.exe
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
    3⤵
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56891.exe
    3⤵
    PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
    3⤵
    PID:6496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54872.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54872.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43399.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45293.exe
        5⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10646.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
        5⤵
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34788.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62275.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33787.exe
      4⤵
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62275.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
      4⤵
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65033.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
      4⤵
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
      4⤵
      PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
      4⤵
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
      4⤵
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
      4⤵
      PID:6528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
    3⤵
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
      4⤵
      PID:6648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8924.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53723.exe
    3⤵
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44206.exe
    3⤵
    PID:5156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5112.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5112.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52226.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
      4⤵
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        5⤵
        
        PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50023.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11724.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7447.exe
      4⤵
      PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
    3⤵
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
      4⤵
      PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
      4⤵
      PID:6904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32362.exe
    3⤵
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38149.exe
      4⤵
      PID:7156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
    3⤵
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61357.exe
    3⤵
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62805.exe
    3⤵
    PID:6364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10616.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10616.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
    3⤵
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
      4⤵
      PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
    3⤵
    PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42259.exe
    3⤵
    PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
    3⤵
    PID:5772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
  2⤵
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-807.exe
    3⤵
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59873.exe
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
    3⤵
    PID:5888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
    3⤵
    PID:6728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe
  2⤵
  PID:2068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16081.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16081.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
  2⤵
  PID:4100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
  2⤵
  PID:5372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe

Filesize
468KB

MD5
612abd0fa4c07511245039651492cc73

SHA1
790abfa4fcbcdd3f456110f5136663f1460091b4

SHA256
800e59edddb482c65b937d025fe5354618ac5b52dc7afbbc421dc196adc10d48

SHA512
6bf845be38632c68a0a33925e82469f96d787b4143e99efdeb211e068443b0a84b279b57cfe375a6a0813abe7fcb6672f2a05128b21e4549ad789a349d80bda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11717.exe

Filesize
468KB

MD5
73d94f7d7271dd1aa2554c44bf28e955

SHA1
c3743931a9a14e8576e0fcd3ca671bf6d0a854a3

SHA256
809d15a5afe44beab1e2af16f2e0cf8859a1048638658f29bea9240a0296670c

SHA512
124e5bc84457175cda35ad94cebdc4aa2847a73861bcec6e898947a2ddcab3c6e2b45840e4bfd3eba793898e5f9dff4ca6effbc074594770668ec050c2555696

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe

Filesize
468KB

MD5
34b64de69f7a6632c61dc8a4bbc9f0d0

SHA1
fcb6283ea0527d3039b8c0d78299595d646d4a21

SHA256
6fe4836b9377a7925cc227ac9c34d7349c64faded31230c0ddb95ca144bcaad3

SHA512
bae844cd312aeec82094a485d9a9c1343bb9b4c98105e5f1f78b60d2481bab24afb21a96ef2966c80c458eeedcffd54a61436d98935758fce6110b2b85d5f91a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe

Filesize
468KB

MD5
df80eeaafce7500dfa48d4bd730c9f15

SHA1
c1186b04b0a6b956cea0b8cdc3e5a4aa974252c4

SHA256
b41b1c3849169d99aeb97d4ac3647a8eda1f203854efe63b888c45038df132f3

SHA512
1d59eddfc9ffa1ae7e8f916f3a40d4746e9d0cb1ba44321a8ee4d6e5ace7d58771336051ad31107ede5ea0021adbcf05575fc1186c6fadb155f393c19cd0f714

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe

Filesize
468KB

MD5
5527fea12fad20e80cac6a4f29344efe

SHA1
29e4106067e7af60d48f90c1a8ed0bf77b6bfb80

SHA256
51b9256b5b3e71f6bde15231aa88e918347a195dd61e4ca67ecd690b713dca18

SHA512
a1b32a0f9282a430c3efebbfc8820c80ada489637d0ca99c15af5dd71a17f9d1e397da3a3863f364026f465894738fb70593a8fb4a09173e19b183a213dc0953

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe

Filesize
468KB

MD5
8df6505f139bbf7612726abbd20a119d

SHA1
db3152415d0542cd276dfe68b23cd3f6a0168f43

SHA256
5a69d6b23fe4dd4353bf4c2e1ea185487b10fdee22c7302ef7f8eb801da937c9

SHA512
ecea021b55e8724c3a42ac98eeafffbdb533e6796977ba62239d5e19d40a89357047d5a86878bd7b0bf735d6bb3a51ce2b34abbc1d27bb30a91187b7fe66120e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62900.exe

Filesize
468KB

MD5
792a70b91c3d9491b7d08b1074db83a2

SHA1
c979fde94d5188b51f96fe39625a5c7b6e66a5af

SHA256
a0bd759eb86779f0cdbdb9f6604a54591edebbe1a939dce06b317290d47d757c

SHA512
ef2c90bda36b56c544d35a8503d0b18dca9943467aab3e920bc54a647f4c00251554a6074d105a8842c404bf161b7c7c21e6bfc605776efb7328783391771bee

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe

Filesize
468KB

MD5
3d882fa78ac11d3980e9e27f4e989c65

SHA1
c4b1c5ca77a455c86a5bdb688fe9f3b593475f62

SHA256
b254a221a6110dd90bb6d0fd03cbf7f8ab3709ff4dbeb0d219811da61e9c06d1

SHA512
b8d6ca852d685ed2f71745e7531623feffe4a76a124847a81216357a6876d3a632293cb4c5559dc80389b9c1628980246ac90a5758d0bce5538f39ab1aba4c02

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe

Filesize
468KB

MD5
0388dd7e87d2c43ddb76ef1f059c3875

SHA1
d97c625fe828918404cbea5e08af43fb68990ef6

SHA256
c40b04b4d2aca569075ad2830a179ddc640ae7e0962577daad6bb8ce599f12c2

SHA512
eabc183c22dad8cefd699a0aa7a66758206fc9f4b051a7cfb72eeac985d1faa934ec3f2e15691c9dc6fc4512428bd8ed1aa52dd72bc97c5ac19ef349aaecfd22

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13336.exe

Filesize
468KB

MD5
84d0d2dc1f1619500cbfaaa0df6ada5b

SHA1
efdb1ad6b2382465f00b187a1ac43783df5c5f66

SHA256
98dd906a0cedf2b7b054551e8214ece0532c8c8c4cfad2f7e0e4b8cbc302d1d0

SHA512
98309f0644acce1dcf083e389ff6f1324722d1f754be61b7bef97a800e05815ed4b3adc453dbc0f1144a3f81418ac8dc46d0fa9754177c91fd8b852f161ce411

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe

Filesize
468KB

MD5
8447f8308ff35b41a120a630af8f319a

SHA1
e21022e2c3d9bbf6968ee4bc8862b5351c72c10d

SHA256
8e3806299df9887b48fd22ae08269b30085e27556d1edc159e2d2156fc08453b

SHA512
cdfd1ba47b16909428bff6e2e776cdbd1b18bd0eeeedf75fc3d5e62b0347f400b42ed0b10684872aa7673bab3b8191fd1a71a60122507a785012cfc09e163b93

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe

Filesize
468KB

MD5
be3c7d19d2810dc1fbfebd26e7014092

SHA1
2998b462b6b6960bf09367874e82aa7b7bc3ac5e

SHA256
1e0c6d8660c5ba281d85e072b1c3477df76a5cc39a2f48dd253362cff9fdb250

SHA512
9fc23fa1bc5947f93be6a831f58be4df349d61f69676dad8d4a36316bad672ca6f6baf5cac20d52575f157021687a0b31780105fc847ff7b37dd63a4168e90ea

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49007.exe

Filesize
468KB

MD5
46418b870e21ddea6379d5b9b893ab57

SHA1
0f96e7758df646009aa5863f9232d0ba0007b0ec

SHA256
8e83d1b3581e37502621463fb8d1deb6f315f9cf8a16da8639f26f338b36ac6b

SHA512
82fdc57f4a533b06fc0970db8282919cbbb3a3c95b47d9e1607f4844b01c2aaa3af16bb96af93fd71f4dd059a93f11659c4e80482b20224146f28dbd6dff27fa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54872.exe

Filesize
468KB

MD5
ee849cc7c237f440d201f63a44ba4a43

SHA1
e28e129edf85b8688cb52a27f1b7eaa854de2b36

SHA256
c64cf969dd909d771992d3e50c57f28881d3ebf3d2902269116da1ba05878faf

SHA512
e5b18fc4058396e9138deb0148690a4b351c0cf42a301670fdb9159981dd4548cc5d5fbd11097a3609132b439de426fbb02449b1843182b5afc42a00abd781c5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe

Filesize
468KB

MD5
aa35b55f5d60ca527571229dff559a4f

SHA1
0bc41f560078f7460abf44dd05adcb6367cd6904

SHA256
668d71506079eb23f9a77714793b26c7103bb9f0d788f461826219a48569d9b2

SHA512
f471a38a843f33fec78bf74a8d2ead798266196d3c5be05ae3e3a6dfd7d93f99fffba378dfa30aadfb55c2aa4839a111cd2c021e7b377c35bb0823fa3be7ac18

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56211.exe

Filesize
468KB

MD5
425e89a8f9677e3f23390a078ee3b99e

SHA1
c86147e76916393869c8e9d1ef1cf7fada9a9e7e

SHA256
6b97698d4170f70499ed2432e5f108f27119b5492adec9a1586c61d8b8e7fb66

SHA512
3ebdbbf8da01f0a9267899569c17ff6e4f032d4410e3cf09b126f7bd272d310cd938040c98f9a0661dbea20e1f0b1db23589ee7f42246a2d8f26143dfd00fca5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59008.exe

Filesize
468KB

MD5
75fc5fed50e23279eeb8e78122d2db88

SHA1
e24499d7c0eba3597600ece160345fae252c2e78

SHA256
34dcae04f498b80a53e50d31a3f0714597551ac8536cb9d5fd32ff5e4ac2ec94

SHA512
56e02bd4a789a9fcc1df1413f0989255923c6f99e28c0b7a5145a858d1a74c9e4e3c97a24b43c63689b2d317c1e94ac7d67f1a5aea5d8fac8890bf63c5b3615f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60098.exe

Filesize
468KB

MD5
6febfae83d05845517d37c6254b21d6c

SHA1
173afae25aee192ee1c2a93a5c774d9cc45cf489

SHA256
c8ef694c61a792198d746901ab7ef702f22c733f567dc8c478bc40b219e3cce4

SHA512
0d05e4cd3c5f26d01fcd82a25af5e289e4823447f0584b3308df73a7796f22e8cc08b048edc0956f4988092a4717a5febdc2d5c9e762d7b15ced79d439d2dd3a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe

Filesize
468KB

MD5
713b89f4be19a02a70ef4db71e03df00

SHA1
3bbe34c8ed12ff853818312b304f0067510eecb8

SHA256
c435bf62efcb4ac9d4c4436894f8c7233a238abe1060ea302fd840d93fca623d

SHA512
0f0c8fe6c6ecdcd82d30f3c5d9315e9bc71d0d7e5a11f35c6960a44e53e59edfc3c59302f072fb9ba1fd406224def20b387b68be9bdcb1cf96efbf9849b8275f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe

Filesize
468KB

MD5
f831b2e861df57430dae700007747e25

SHA1
9f87dd139490b7b802cb7b7b39dfb4f029c2e74f

SHA256
9357404c69c9e7ad3f62c0c3228e1ae704d00d01b8c95bceedb38ff256cca42b

SHA512
087bc5206013388cd965740dac394bbd1533590c534244eca445eb93d492fe3c9c4ad112d5b83b2dbdea92e553039983a7061047d2286ef5338abbba429d99a2

Download Submit