ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803e

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
Size

468KB
MD5

0111b1fd6719046b62cbfe6f56dd2bd0
SHA1

96eb572b5564a4d3c8e7c979f7fd7090b22ce8b3
SHA256

ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803e
SHA512

227f547c8a53485a52d7c53f3d4b8f224882b1596abefff2eeae3e5f288a8d4861b09c37668b6b24f2b3256f283fbe832f58f72681df25b9c1dfb5bf50ba9ab4
SSDEEP

3072:wbFOogJER05BtgYtPzDjqB8uECnZRnp5nmHh9oh+e4tc8cmQkCEI:wbIoR8BtTPfjqB9pI9e4C1mQk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2108	Unicorn-13477.exe
2920	Unicorn-15267.exe
1732	Unicorn-31049.exe
2852	Unicorn-48620.exe
2724	Unicorn-41421.exe
2632	Unicorn-3503.exe
2648	Unicorn-52190.exe
2776	Unicorn-44666.exe
1716	Unicorn-32776.exe
1788	Unicorn-58262.exe
1888	Unicorn-58817.exe
2420	Unicorn-13145.exe
2804	Unicorn-57805.exe
2044	Unicorn-51940.exe
1432	Unicorn-58153.exe
3052	Unicorn-54624.exe
1684	Unicorn-64136.exe
2368	Unicorn-47053.exe
552	Unicorn-65235.exe
1072	Unicorn-13996.exe
2784	Unicorn-38501.exe
1784	Unicorn-36455.exe
2084	Unicorn-1552.exe
928	Unicorn-1552.exe
2224	Unicorn-25734.exe
2252	Unicorn-54323.exe
1288	Unicorn-65258.exe
768	Unicorn-12735.exe
2548	Unicorn-60000.exe
1552	Unicorn-6067.exe
1728	Unicorn-40276.exe
1480	Unicorn-65527.exe
548	Unicorn-50482.exe
1600	Unicorn-51459.exe
2372	Unicorn-13533.exe
2696	Unicorn-43099.exe
2500	Unicorn-3690.exe
2380	Unicorn-18403.exe
2712	Unicorn-54894.exe
2904	Unicorn-46991.exe
2204	Unicorn-2429.exe
2604	Unicorn-54967.exe
2680	Unicorn-2953.exe
2176	Unicorn-27723.exe
2092	Unicorn-27723.exe
820	Unicorn-3581.exe
2564	Unicorn-35699.exe
1724	Unicorn-788.exe
1900	Unicorn-27339.exe
2840	Unicorn-27339.exe
1272	Unicorn-36061.exe
620	Unicorn-46997.exe
1744	Unicorn-47759.exe
2964	Unicorn-51843.exe
1424	Unicorn-64650.exe
1644	Unicorn-13933.exe
680	Unicorn-55735.exe
1476	Unicorn-10108.exe
628	Unicorn-8838.exe
2460	Unicorn-49357.exe
1184	Unicorn-24106.exe
2928	Unicorn-36912.exe
1548	Unicorn-3493.exe
828	Unicorn-61225.exe

Loads dropped DLL 64 IoCs

pid	Process
1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
2108	Unicorn-13477.exe
1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
2108	Unicorn-13477.exe
2920	Unicorn-15267.exe
2920	Unicorn-15267.exe
1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
1732	Unicorn-31049.exe
1732	Unicorn-31049.exe
2108	Unicorn-13477.exe
2108	Unicorn-13477.exe
2852	Unicorn-48620.exe
2852	Unicorn-48620.exe
2920	Unicorn-15267.exe
2920	Unicorn-15267.exe
2632	Unicorn-3503.exe
2632	Unicorn-3503.exe
1732	Unicorn-31049.exe
2648	Unicorn-52190.exe
1732	Unicorn-31049.exe
2648	Unicorn-52190.exe
1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
2108	Unicorn-13477.exe
2108	Unicorn-13477.exe
2776	Unicorn-44666.exe
2776	Unicorn-44666.exe
2852	Unicorn-48620.exe
2852	Unicorn-48620.exe
2724	Unicorn-41421.exe
2724	Unicorn-41421.exe
1716	Unicorn-32776.exe
1716	Unicorn-32776.exe
2920	Unicorn-15267.exe
2920	Unicorn-15267.exe
1888	Unicorn-58817.exe
1888	Unicorn-58817.exe
2420	Unicorn-13145.exe
2420	Unicorn-13145.exe
1732	Unicorn-31049.exe
1732	Unicorn-31049.exe
1788	Unicorn-58262.exe
2804	Unicorn-57805.exe
1788	Unicorn-58262.exe
2804	Unicorn-57805.exe
2648	Unicorn-52190.exe
2648	Unicorn-52190.exe
2632	Unicorn-3503.exe
1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
2632	Unicorn-3503.exe
1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
2044	Unicorn-51940.exe
2044	Unicorn-51940.exe
2108	Unicorn-13477.exe
2108	Unicorn-13477.exe
1432	Unicorn-58153.exe
1432	Unicorn-58153.exe
3052	Unicorn-54624.exe
3052	Unicorn-54624.exe
2776	Unicorn-44666.exe
2776	Unicorn-44666.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	2872	WerFault.exe	106

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8717.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
2108	Unicorn-13477.exe
2920	Unicorn-15267.exe
1732	Unicorn-31049.exe
2852	Unicorn-48620.exe
2724	Unicorn-41421.exe
2632	Unicorn-3503.exe
2648	Unicorn-52190.exe
2776	Unicorn-44666.exe
1716	Unicorn-32776.exe
1788	Unicorn-58262.exe
2420	Unicorn-13145.exe
2044	Unicorn-51940.exe
1888	Unicorn-58817.exe
2804	Unicorn-57805.exe
1432	Unicorn-58153.exe
3052	Unicorn-54624.exe
1684	Unicorn-64136.exe
2368	Unicorn-47053.exe
552	Unicorn-65235.exe
1072	Unicorn-13996.exe
2784	Unicorn-38501.exe
1784	Unicorn-36455.exe
2084	Unicorn-1552.exe
928	Unicorn-1552.exe
2224	Unicorn-25734.exe
768	Unicorn-12735.exe
2252	Unicorn-54323.exe
1288	Unicorn-65258.exe
2548	Unicorn-60000.exe
1552	Unicorn-6067.exe
1728	Unicorn-40276.exe
1480	Unicorn-65527.exe
548	Unicorn-50482.exe
1600	Unicorn-51459.exe
2372	Unicorn-13533.exe
2696	Unicorn-43099.exe
2500	Unicorn-3690.exe
2380	Unicorn-18403.exe
2712	Unicorn-54894.exe
2904	Unicorn-46991.exe
2204	Unicorn-2429.exe
2604	Unicorn-54967.exe
2680	Unicorn-2953.exe
2092	Unicorn-27723.exe
2176	Unicorn-27723.exe
820	Unicorn-3581.exe
2564	Unicorn-35699.exe
1900	Unicorn-27339.exe
1724	Unicorn-788.exe
2840	Unicorn-27339.exe
1272	Unicorn-36061.exe
620	Unicorn-46997.exe
2964	Unicorn-51843.exe
1744	Unicorn-47759.exe
1644	Unicorn-13933.exe
1424	Unicorn-64650.exe
680	Unicorn-55735.exe
1476	Unicorn-10108.exe
628	Unicorn-8838.exe
2460	Unicorn-49357.exe
1184	Unicorn-24106.exe
2928	Unicorn-36912.exe
1548	Unicorn-3493.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2108	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	30
PID 1916 wrote to memory of 2108	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	30
PID 1916 wrote to memory of 2108	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	30
PID 1916 wrote to memory of 2108	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	30
PID 1916 wrote to memory of 2920	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	32
PID 1916 wrote to memory of 2920	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	32
PID 1916 wrote to memory of 2920	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	32
PID 1916 wrote to memory of 2920	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	32
PID 2108 wrote to memory of 1732	2108	Unicorn-13477.exe	31
PID 2108 wrote to memory of 1732	2108	Unicorn-13477.exe	31
PID 2108 wrote to memory of 1732	2108	Unicorn-13477.exe	31
PID 2108 wrote to memory of 1732	2108	Unicorn-13477.exe	31
PID 2920 wrote to memory of 2852	2920	Unicorn-15267.exe	33
PID 2920 wrote to memory of 2852	2920	Unicorn-15267.exe	33
PID 2920 wrote to memory of 2852	2920	Unicorn-15267.exe	33
PID 2920 wrote to memory of 2852	2920	Unicorn-15267.exe	33
PID 1916 wrote to memory of 2724	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	34
PID 1916 wrote to memory of 2724	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	34
PID 1916 wrote to memory of 2724	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	34
PID 1916 wrote to memory of 2724	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	34
PID 1732 wrote to memory of 2632	1732	Unicorn-31049.exe	35
PID 1732 wrote to memory of 2632	1732	Unicorn-31049.exe	35
PID 1732 wrote to memory of 2632	1732	Unicorn-31049.exe	35
PID 1732 wrote to memory of 2632	1732	Unicorn-31049.exe	35
PID 2108 wrote to memory of 2648	2108	Unicorn-13477.exe	36
PID 2108 wrote to memory of 2648	2108	Unicorn-13477.exe	36
PID 2108 wrote to memory of 2648	2108	Unicorn-13477.exe	36
PID 2108 wrote to memory of 2648	2108	Unicorn-13477.exe	36
PID 2852 wrote to memory of 2776	2852	Unicorn-48620.exe	37
PID 2852 wrote to memory of 2776	2852	Unicorn-48620.exe	37
PID 2852 wrote to memory of 2776	2852	Unicorn-48620.exe	37
PID 2852 wrote to memory of 2776	2852	Unicorn-48620.exe	37
PID 2920 wrote to memory of 1716	2920	Unicorn-15267.exe	38
PID 2920 wrote to memory of 1716	2920	Unicorn-15267.exe	38
PID 2920 wrote to memory of 1716	2920	Unicorn-15267.exe	38
PID 2920 wrote to memory of 1716	2920	Unicorn-15267.exe	38
PID 2632 wrote to memory of 1788	2632	Unicorn-3503.exe	39
PID 2632 wrote to memory of 1788	2632	Unicorn-3503.exe	39
PID 2632 wrote to memory of 1788	2632	Unicorn-3503.exe	39
PID 2632 wrote to memory of 1788	2632	Unicorn-3503.exe	39
PID 1732 wrote to memory of 1888	1732	Unicorn-31049.exe	40
PID 1732 wrote to memory of 1888	1732	Unicorn-31049.exe	40
PID 1732 wrote to memory of 1888	1732	Unicorn-31049.exe	40
PID 1732 wrote to memory of 1888	1732	Unicorn-31049.exe	40
PID 2648 wrote to memory of 2420	2648	Unicorn-52190.exe	41
PID 2648 wrote to memory of 2420	2648	Unicorn-52190.exe	41
PID 2648 wrote to memory of 2420	2648	Unicorn-52190.exe	41
PID 2648 wrote to memory of 2420	2648	Unicorn-52190.exe	41
PID 1916 wrote to memory of 2804	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	42
PID 1916 wrote to memory of 2804	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	42
PID 1916 wrote to memory of 2804	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	42
PID 1916 wrote to memory of 2804	1916	ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe	42
PID 2108 wrote to memory of 2044	2108	Unicorn-13477.exe	43
PID 2108 wrote to memory of 2044	2108	Unicorn-13477.exe	43
PID 2108 wrote to memory of 2044	2108	Unicorn-13477.exe	43
PID 2108 wrote to memory of 2044	2108	Unicorn-13477.exe	43
PID 2776 wrote to memory of 1432	2776	Unicorn-44666.exe	44
PID 2776 wrote to memory of 1432	2776	Unicorn-44666.exe	44
PID 2776 wrote to memory of 1432	2776	Unicorn-44666.exe	44
PID 2776 wrote to memory of 1432	2776	Unicorn-44666.exe	44
PID 2852 wrote to memory of 3052	2852	Unicorn-48620.exe	45
PID 2852 wrote to memory of 3052	2852	Unicorn-48620.exe	45
PID 2852 wrote to memory of 3052	2852	Unicorn-48620.exe	45
PID 2852 wrote to memory of 3052	2852	Unicorn-48620.exe	45

C:\Users\Admin\AppData\Local\Temp\ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe
"C:\Users\Admin\AppData\Local\Temp\ef78f4e8e22c53e9f9182f7adbd8b99067aeb4a613d9a27efd50b6a2beb0803eN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13477.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13477.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3503.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58262.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
        8⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 188
        9⤵
        Program crash
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        8⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        8⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54977.exe
        7⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        8⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        8⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        8⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        8⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
        8⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
        7⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        7⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47047.exe
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10383.exe
        6⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39918.exe
        7⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        7⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        7⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
        6⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        6⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54323.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16021.exe
        7⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        8⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        8⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49696.exe
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10042.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        7⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        6⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        7⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        7⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
        7⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47047.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8375.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        7⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59217.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        6⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        5⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41720.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58817.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46991.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
        7⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        8⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        8⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        7⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        7⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
        6⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
        7⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        6⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        6⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        6⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18925.exe
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26544.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
        5⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
        5⤵
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        5⤵
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36455.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36742.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5403.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42193.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36485.exe
        7⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        6⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        6⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
        5⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
        6⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2953.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        5⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        6⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        6⤵
        
        PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        5⤵
        
        PID:356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
      4⤵
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1353.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        5⤵
        
        PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exe
      4⤵
      PID:5192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13145.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        7⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        8⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36784.exe
        8⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59217.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exe
        6⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19338.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        7⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61794.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        6⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13519.exe
        6⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17656.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
        7⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        6⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12241.exe
        5⤵
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29995.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        6⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25734.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35699.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
        6⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
        5⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-788.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        5⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49696.exe
        6⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        5⤵
        
        PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37328.exe
      4⤵
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-357.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8911.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12975.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41344.exe
      4⤵
      PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        6⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28651.exe
        5⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        5⤵
        
        PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        6⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28651.exe
        5⤵
        
        PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        5⤵
        
        PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
      4⤵
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
      4⤵
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
      4⤵
      PID:6960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62398.exe
        5⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44845.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        6⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17845.exe
        5⤵
        
        PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        5⤵
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
      4⤵
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15160.exe
        5⤵
        
        PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
      4⤵
      PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-644.exe
      4⤵
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        5⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        5⤵
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
      4⤵
      PID:484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
      4⤵
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
      4⤵
      PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4307.exe
    3⤵
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
      4⤵
      PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
      4⤵
      PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
    3⤵
    PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
    3⤵
    PID:6660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15267.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15267.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48620.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44666.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        8⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        8⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        8⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6495.exe
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45948.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
        7⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33155.exe
        8⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36692.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33896.exe
        6⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
        7⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20003.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52409.exe
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19638.exe
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47894.exe
        7⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        7⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        7⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        6⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50264.exe
        5⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        6⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        6⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
        5⤵
        
        PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24106.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        7⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36485.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
        7⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        6⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        6⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        6⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36912.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        6⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        5⤵
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50482.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        5⤵
        
        PID:308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        6⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15775.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47047.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
      4⤵
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11184.exe
        5⤵
        
        PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        5⤵
        
        PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8942.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34145.exe
      4⤵
      PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43099.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
        6⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
        7⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36073.exe
        8⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        8⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        8⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        7⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        7⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64510.exe
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46860.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        7⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20194.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
        6⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42193.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
        6⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3690.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        6⤵
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        5⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63668.exe
      4⤵
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        5⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45948.exe
        6⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        6⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11692.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43966.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14659.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
      4⤵
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        5⤵
        
        PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25035.exe
      4⤵
      PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
      4⤵
      PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe
      4⤵
      PID:6604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
        5⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53496.exe
        6⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41031.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        5⤵
        
        PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
      4⤵
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        5⤵
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46956.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17077.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exe
      4⤵
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2760.exe
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
      4⤵
      PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
      4⤵
      PID:6588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4728.exe
      4⤵
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19787.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26544.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exe
      4⤵
      PID:6512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
    3⤵
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
      4⤵
      PID:6420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53617.exe
    3⤵
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58786.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
    3⤵
    PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37528.exe
    3⤵
    PID:6596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51459.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5403.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        6⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        5⤵
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
      4⤵
      Executes dropped EXE
      PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
        5⤵
        
        PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        5⤵
        
        PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
      4⤵
      PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
      4⤵
      PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
      4⤵
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39537.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63081.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
      4⤵
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11004.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
      4⤵
      PID:5356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11780.exe
    3⤵
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
      4⤵
      PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
    3⤵
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exe
    3⤵
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-582.exe
    3⤵
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34145.exe
    3⤵
    PID:5128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
        5⤵
        
        PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51879.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42860.exe
        5⤵
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exe
      4⤵
      PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
      4⤵
      PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
      4⤵
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36061.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
      4⤵
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
    3⤵
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
    3⤵
    PID:6612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51843.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
      4⤵
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe
        5⤵
        
        PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
      4⤵
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
      4⤵
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
      4⤵
      PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exe
    3⤵
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
      4⤵
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
    3⤵
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
    3⤵
    PID:5712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13933.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13933.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
    3⤵
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
      4⤵
      PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
      4⤵
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
      4⤵
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11692.exe
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
    3⤵
    PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
    3⤵
    PID:5728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
  2⤵
  PID:812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11291.exe
    3⤵
    PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56429.exe
    3⤵
    PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
    3⤵
    PID:7048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-335.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-335.exe
  2⤵
  PID:3776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
  2⤵
  PID:4848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
  2⤵
  PID:5372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53956.exe
  2⤵
  PID:6216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13145.exe

Filesize
468KB

MD5
3bd8fdaf6f3cf9ca3a6941b73eb00981

SHA1
fd02f6f6996129af15a3844ca0c6303d3b520c11

SHA256
593861aa3f3e26bbb57edafdedb882fa2910db2f23f0a1122e8482ccfb7018d0

SHA512
ca65e3cd3dab1d022ffea40822cce245636a262bb6b49733978cd27a023ac0e7e069a9030fbbe0dc7a1c64e32b51d8a3e605ab4fbb640d3c28afb216555e9a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15267.exe

Filesize
468KB

MD5
9c40af8031ba2bad35428b25aacca215

SHA1
0d981966882c82c17187aae41c9ed3ec84c11f56

SHA256
65a4ba48c2af2273405dfa598086a2ebbf67081b27666442c3047c191cae5c28

SHA512
32682685f549189227b02e81ae2d171ff274f19d46373a5f1136e5b46c254fed52d65a4be69559ab0c7f559895d58259bbc7f0e10f082fc8f0d8a084b55821f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3503.exe

Filesize
468KB

MD5
a46659e818001a3d871f5017891df8ab

SHA1
8fb749f9dadf44ce7b2df8930ea22bd44c2bad62

SHA256
1e4f477f56bb09dd0bfc5f1c52a6b887945d2de3459a5ea6ed8cbc533e7fe234

SHA512
9ad561f50a2141d9bccc53199d0f920a7376f733f8090c666edee047db0d4d927667f9a2a0fa2d3657ca8890026a4241e51b8f6b98801891d067ebca16b76c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe

Filesize
468KB

MD5
6de5a47326ba601d757b625ad925b093

SHA1
05b6637c32dd634772798869af189f5291507fd7

SHA256
f38a51d0390a237fa58470255420b7db34e839b6ddf657121a4c6e69e7c43cb7

SHA512
2c62b47f77a09ca92a941c90a28770f6ce5d6505002b33839f1dc17cf3f387a3f179cadd6a8520b4152740a20d58680f370c78d487f1b6fea7161bb6689fcbfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44666.exe

Filesize
468KB

MD5
515696da6778a2402097395165f66d28

SHA1
1915953acdb3af921759b7c79a4e4e202628915e

SHA256
ea7e49a5b37213c1c780d526c8f9f12032456f0ee574fbbb62c23158de952dcb

SHA512
c386f6434e32918241d685d06308d58ae39f84748963b69d2535ba1abf424a4bdf18ece3c7611652751f565fee294be2c556e2a84236db2f8074347bb75959b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe

Filesize
468KB

MD5
b8e209a75bce97a387927d3fd0660c65

SHA1
d06f7ba2274e7162b77d2df09621c14ca18bb5d3

SHA256
1eba2dbb01a2674b13a41b47517100032c471e1df0b72b5e9ce907de513821c9

SHA512
38f7c97f02cfc39a4cb6f34ca8adfc505958b846048e0969558d1a71dd139640bd34717b66d290325654f09b12521655a2a087bcdcf3701da93209818c9e0897

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe

Filesize
468KB

MD5
17fdfd30fe9558f44709a38d53b2cb6e

SHA1
4cd9730e1809ac3cb6673170f41367b90be55181

SHA256
8ee6037ae72f8e8b59d98ba6359b1b0d321147f9986f89143fc45aa5104bccec

SHA512
b83916d75a0da239edf69be8e1bb39c7a52baec150f33346cd811df07f15eab9c22a24c9d83a99f17f2c429f01312b70cb0fafce5c2fb6b6e8d2f9f37f6b52a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe

Filesize
468KB

MD5
da4379ad55e6c403375dacaa8a0f5da1

SHA1
023e50d8fcc7648d6ab7c94ca0efa77a8552a45b

SHA256
b5ad4f85e23e3bd437f6ae0fc249cff7aae19b122a9780c9f79c95d553db806d

SHA512
3969980cd85385e663341fbf16d6e49bfc6cb1a5053b8acbb42035cd10eb844f26a5a100faafee208bc380acfd5f3d2b556af9f7ba62322b9b7fc67978ff9dc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58262.exe

Filesize
468KB

MD5
f37d71db68e0fe808a7fa84471ed5465

SHA1
01ee4d7a3aa942a65ed63b9576f40630ae8d4e00

SHA256
d83cbb13cf32a01d1fd007878fbb8ba33a8e8658efb1feb89392fab9ab783900

SHA512
173195e63583fdbe90693c9fe0074d797b06cad85a7060802c5bbb4c7fb38c082340a37fe31a04bf09202837796575f359f4e7d0e38ee443f5bb969a6aea1d4e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13477.exe

Filesize
468KB

MD5
265e3a087d8319e2c8ec0d0865dc9542

SHA1
6bafbe384fcb8ed38096837127bd51d5f21c3d8c

SHA256
5d99c987b1aa6f15ca3eb5f1f9c005e2527324bcf09f6e2f2092b12f4ab134c2

SHA512
982beb28d4d76afda0f72be6901bf0e861d85c0a7d00ef0ee37d8a35ed266a63008f851aa4c8fea3eb2147ae029057b21012559eb9e4a8ded1ab104b5a79bae2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe

Filesize
468KB

MD5
fd2f4006744f847ad7eddef0a2cb1cb1

SHA1
817a569a03b055bd447e78c18453a406b271e40a

SHA256
969d9be786a8c4f297b7abb8f381852a22df48f5886dc6222ff91632765b1e06

SHA512
746d89eb9f2df0bbce8b1357353a400e8f91cde43ef1d57eb85ba85f565e19700e1966989bcda90c6b4453b8d7dfb057d374903702ba9ebb3a83d1f1579baa23

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe

Filesize
468KB

MD5
04d85522ba5bf602994a827f4b36541b

SHA1
6cc1f264fe577bc98e4910971bac88860fecd65d

SHA256
77c5aa9ca5d4950a704bc32190cb6b435901be80f004f6d25d285d698bfd8c8f

SHA512
4585827ff3680123e00fe94ca12bafcb54c9230b5a44f0343ae7fe237d90da5e9fcceb1c1a72592d76040fbea46d0c5d83aa123f16155aeca03847822eeb3167

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48620.exe

Filesize
468KB

MD5
fa428de11da8e1aa86279effa2a53aca

SHA1
c202f672e11a3838aa2b420ee03da44904464e8a

SHA256
c7c50fa1d140abbaf59f0272de23c9059fb927e14c85f03879ead7c898a6e889

SHA512
c47d5c3b14ef2dd265fb4734a8c6c8e9ab21f40de2c4668a4b08f960ca9b8f68901c6c5c95de23312b4524dbb2124ec87e23d3c926aabeae892afdda933d0317

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe

Filesize
468KB

MD5
5d4ab0ff3d89615678763d2669f4751a

SHA1
b63f3deabe62ac57656a92aedd21c9bb59e6415c

SHA256
e0d629fc6a6d00aa3ad1ca0429ce9c294bc4b73a87a06bba03166b9fcf8e6d3f

SHA512
a7fdf2442d4c2d50778f1a8bcd80f6cbe192ce0b831f63d64a8f1e2380332a732563fe4f8f0b971fa6cfa3866d3c365293d34e01cc9272bb588d7a68d7f2be47

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe

Filesize
468KB

MD5
e8fb0df6e03ebe97f1626a8598b54268

SHA1
0bec4844f904e746612d18aa6b19dbf8df851c1e

SHA256
8e1f09eb5554c94503a490e8f452dadf47de4bc2ca0963619d4980597324cea4

SHA512
fbab81453bf96ee3c28b26210693663fe00300ba4ddea6845f3d1f90c00c694df92e2d00c9798fd29ec47c060a9b8ed51a46c96b481bfb687fdf63b1699ad537

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe

Filesize
468KB

MD5
93cd20abb97ed2bdcf69faa886b73c5c

SHA1
6febeadf1495bec6d0b1a116a95b2a6ba5c85071

SHA256
b867712e2d36416102cd52944b5242eec95d67aa590142b5799656e1a71aae48

SHA512
9fe45225c65bdae5928ca29b72785dd120ec2adb6e337cd1069ece959c995c351f9f6653073b59fa2fa0247181e8329c6e08e112624e35463e09c83a004e5595

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58817.exe

Filesize
468KB

MD5
869c09fb43bfcb020d3162d3d5843941

SHA1
040e0438d5830bde21aadd0037fe0c8332917156

SHA256
fe01b0770dd3e899dab333afe3835078feaed083c58fba6ec2c6d4cebcc5e87a

SHA512
28d2a745e2695fcb39d1f73f6aff4b239e2743216f13478a448c2649ddcf34c6f61235e1914a4c6fc50d03b13f06cd6134a21214e0faae242a9e3067d7c4c2e7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe

Filesize
468KB

MD5
304d3ec26c22ab8e2b0ed72d701b19aa

SHA1
5554343c0c674e2792ea4205d01f1ea9f1b2beb8

SHA256
8b8fdbbd92a5be51bad3c2698afd625d69248c404eaabb2dd838e7052bc67fa6

SHA512
d3dea571843459f9eb71e4007ba018a1d13597537d151a1f9234696badef263665bf5ed1a49b9bf79354431b55b96cc631649ee970b4b652d6294842f24bc7ca

Download Submit