70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
Size

468KB
MD5

5ae5ccc6cb24ecbc5e6450824c1bbe20
SHA1

217e0616421d51f07edbcdb5577e26b1638ebbe0
SHA256

70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6
SHA512

d19402700424277c50a3a1327dcfd80a44002031590b3be7aa7b6db815105143baa67ac6b4609b69764a5d88c98c35884abd67b386b45553b7ca5647f29f88e0
SSDEEP

3072:5MACogbdhZJBtbYJPzcBff8/EChXsaplnlHCxEuUdkc2c9sgaVEQ:5M1oy/BtOP4BfflSmGdkrYsga

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2900	Unicorn-19191.exe
2088	Unicorn-3176.exe
2784	Unicorn-52932.exe
2696	Unicorn-38646.exe
2528	Unicorn-39200.exe
2604	Unicorn-5973.exe
2656	Unicorn-65380.exe
2364	Unicorn-950.exe
264	Unicorn-9865.exe
1496	Unicorn-46259.exe
2824	Unicorn-56465.exe
2872	Unicorn-62595.exe
1104	Unicorn-50898.exe
844	Unicorn-17405.exe
1300	Unicorn-41272.exe
2756	Unicorn-33658.exe
1872	Unicorn-14307.exe
1664	Unicorn-38257.exe
1800	Unicorn-24918.exe
2928	Unicorn-47577.exe
1916	Unicorn-53699.exe
2204	Unicorn-2460.exe
2376	Unicorn-6279.exe
1748	Unicorn-10628.exe
984	Unicorn-15459.exe
1728	Unicorn-26394.exe
1552	Unicorn-39409.exe
464	Unicorn-31987.exe
2140	Unicorn-41630.exe
1200	Unicorn-46461.exe
1752	Unicorn-38506.exe
2420	Unicorn-50758.exe
2072	Unicorn-44628.exe
2440	Unicorn-55589.exe
2216	Unicorn-14001.exe
1600	Unicorn-14748.exe
2584	Unicorn-54769.exe
2768	Unicorn-50950.exe
2800	Unicorn-16231.exe
2680	Unicorn-38122.exe
2712	Unicorn-1100.exe
2860	Unicorn-1365.exe
2496	Unicorn-11571.exe
2564	Unicorn-21786.exe
2128	Unicorn-40352.exe
3020	Unicorn-58734.exe
1244	Unicorn-58734.exe
1488	Unicorn-3036.exe
988	Unicorn-13971.exe
2864	Unicorn-7120.exe
2724	Unicorn-43322.exe
860	Unicorn-55766.exe
2344	Unicorn-48153.exe
2552	Unicorn-35346.exe
1996	Unicorn-15480.exe
2728	Unicorn-39537.exe
1932	Unicorn-4126.exe
2092	Unicorn-597.exe
2124	Unicorn-28631.exe
2940	Unicorn-52049.exe
1420	Unicorn-21423.exe
1136	Unicorn-46674.exe
788	Unicorn-9362.exe
2392	Unicorn-13446.exe

Loads dropped DLL 64 IoCs

pid	Process
800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
2900	Unicorn-19191.exe
2900	Unicorn-19191.exe
800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
2088	Unicorn-3176.exe
2088	Unicorn-3176.exe
2900	Unicorn-19191.exe
2900	Unicorn-19191.exe
800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
2784	Unicorn-52932.exe
2784	Unicorn-52932.exe
800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
2696	Unicorn-38646.exe
2696	Unicorn-38646.exe
2088	Unicorn-3176.exe
2088	Unicorn-3176.exe
2528	Unicorn-39200.exe
2528	Unicorn-39200.exe
2900	Unicorn-19191.exe
2656	Unicorn-65380.exe
2900	Unicorn-19191.exe
2656	Unicorn-65380.exe
2784	Unicorn-52932.exe
2784	Unicorn-52932.exe
800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
2364	Unicorn-950.exe
2364	Unicorn-950.exe
2696	Unicorn-38646.exe
2696	Unicorn-38646.exe
2604	Unicorn-5973.exe
2604	Unicorn-5973.exe
264	Unicorn-9865.exe
264	Unicorn-9865.exe
2088	Unicorn-3176.exe
2088	Unicorn-3176.exe
1104	Unicorn-50898.exe
1104	Unicorn-50898.exe
2784	Unicorn-52932.exe
2784	Unicorn-52932.exe
2900	Unicorn-19191.exe
2824	Unicorn-56465.exe
2900	Unicorn-19191.exe
2824	Unicorn-56465.exe
844	Unicorn-17405.exe
844	Unicorn-17405.exe
2656	Unicorn-65380.exe
800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
2656	Unicorn-65380.exe
1496	Unicorn-46259.exe
1496	Unicorn-46259.exe
2528	Unicorn-39200.exe
2528	Unicorn-39200.exe
1300	Unicorn-41272.exe
1300	Unicorn-41272.exe
2364	Unicorn-950.exe
2364	Unicorn-950.exe
1872	Unicorn-14307.exe
1872	Unicorn-14307.exe
1664	Unicorn-38257.exe
1664	Unicorn-38257.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	2468	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1365.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
2900	Unicorn-19191.exe
2088	Unicorn-3176.exe
2784	Unicorn-52932.exe
2696	Unicorn-38646.exe
2528	Unicorn-39200.exe
2656	Unicorn-65380.exe
2604	Unicorn-5973.exe
2364	Unicorn-950.exe
264	Unicorn-9865.exe
1104	Unicorn-50898.exe
2872	Unicorn-62595.exe
844	Unicorn-17405.exe
2824	Unicorn-56465.exe
1496	Unicorn-46259.exe
1300	Unicorn-41272.exe
2756	Unicorn-33658.exe
1872	Unicorn-14307.exe
1664	Unicorn-38257.exe
1800	Unicorn-24918.exe
2928	Unicorn-47577.exe
1916	Unicorn-53699.exe
2204	Unicorn-2460.exe
2376	Unicorn-6279.exe
1748	Unicorn-10628.exe
984	Unicorn-15459.exe
1552	Unicorn-39409.exe
464	Unicorn-31987.exe
1728	Unicorn-26394.exe
2140	Unicorn-41630.exe
1200	Unicorn-46461.exe
2420	Unicorn-50758.exe
1752	Unicorn-38506.exe
2072	Unicorn-44628.exe
2216	Unicorn-14001.exe
2440	Unicorn-55589.exe
1600	Unicorn-14748.exe
2584	Unicorn-54769.exe
2768	Unicorn-50950.exe
2800	Unicorn-16231.exe
2680	Unicorn-38122.exe
2860	Unicorn-1365.exe
2712	Unicorn-1100.exe
2564	Unicorn-21786.exe
2496	Unicorn-11571.exe
2128	Unicorn-40352.exe
1244	Unicorn-58734.exe
3020	Unicorn-58734.exe
1488	Unicorn-3036.exe
988	Unicorn-13971.exe
2724	Unicorn-43322.exe
2864	Unicorn-7120.exe
860	Unicorn-55766.exe
2344	Unicorn-48153.exe
1996	Unicorn-15480.exe
2552	Unicorn-35346.exe
2728	Unicorn-39537.exe
1932	Unicorn-4126.exe
2092	Unicorn-597.exe
2124	Unicorn-28631.exe
2940	Unicorn-52049.exe
1420	Unicorn-21423.exe
1136	Unicorn-46674.exe
788	Unicorn-9362.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2900	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	28
PID 800 wrote to memory of 2900	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	28
PID 800 wrote to memory of 2900	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	28
PID 800 wrote to memory of 2900	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	28
PID 2900 wrote to memory of 2088	2900	Unicorn-19191.exe	29
PID 2900 wrote to memory of 2088	2900	Unicorn-19191.exe	29
PID 2900 wrote to memory of 2088	2900	Unicorn-19191.exe	29
PID 2900 wrote to memory of 2088	2900	Unicorn-19191.exe	29
PID 800 wrote to memory of 2784	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	30
PID 800 wrote to memory of 2784	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	30
PID 800 wrote to memory of 2784	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	30
PID 800 wrote to memory of 2784	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	30
PID 2088 wrote to memory of 2696	2088	Unicorn-3176.exe	31
PID 2088 wrote to memory of 2696	2088	Unicorn-3176.exe	31
PID 2088 wrote to memory of 2696	2088	Unicorn-3176.exe	31
PID 2088 wrote to memory of 2696	2088	Unicorn-3176.exe	31
PID 2900 wrote to memory of 2528	2900	Unicorn-19191.exe	32
PID 2900 wrote to memory of 2528	2900	Unicorn-19191.exe	32
PID 2900 wrote to memory of 2528	2900	Unicorn-19191.exe	32
PID 2900 wrote to memory of 2528	2900	Unicorn-19191.exe	32
PID 800 wrote to memory of 2656	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	33
PID 800 wrote to memory of 2656	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	33
PID 800 wrote to memory of 2656	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	33
PID 800 wrote to memory of 2656	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	33
PID 2784 wrote to memory of 2604	2784	Unicorn-52932.exe	34
PID 2784 wrote to memory of 2604	2784	Unicorn-52932.exe	34
PID 2784 wrote to memory of 2604	2784	Unicorn-52932.exe	34
PID 2784 wrote to memory of 2604	2784	Unicorn-52932.exe	34
PID 2696 wrote to memory of 2364	2696	Unicorn-38646.exe	35
PID 2696 wrote to memory of 2364	2696	Unicorn-38646.exe	35
PID 2696 wrote to memory of 2364	2696	Unicorn-38646.exe	35
PID 2696 wrote to memory of 2364	2696	Unicorn-38646.exe	35
PID 2088 wrote to memory of 264	2088	Unicorn-3176.exe	36
PID 2088 wrote to memory of 264	2088	Unicorn-3176.exe	36
PID 2088 wrote to memory of 264	2088	Unicorn-3176.exe	36
PID 2088 wrote to memory of 264	2088	Unicorn-3176.exe	36
PID 2528 wrote to memory of 1496	2528	Unicorn-39200.exe	37
PID 2528 wrote to memory of 1496	2528	Unicorn-39200.exe	37
PID 2528 wrote to memory of 1496	2528	Unicorn-39200.exe	37
PID 2528 wrote to memory of 1496	2528	Unicorn-39200.exe	37
PID 2900 wrote to memory of 2824	2900	Unicorn-19191.exe	38
PID 2900 wrote to memory of 2824	2900	Unicorn-19191.exe	38
PID 2900 wrote to memory of 2824	2900	Unicorn-19191.exe	38
PID 2900 wrote to memory of 2824	2900	Unicorn-19191.exe	38
PID 2656 wrote to memory of 2872	2656	Unicorn-65380.exe	39
PID 2656 wrote to memory of 2872	2656	Unicorn-65380.exe	39
PID 2656 wrote to memory of 2872	2656	Unicorn-65380.exe	39
PID 2656 wrote to memory of 2872	2656	Unicorn-65380.exe	39
PID 2784 wrote to memory of 1104	2784	Unicorn-52932.exe	40
PID 2784 wrote to memory of 1104	2784	Unicorn-52932.exe	40
PID 2784 wrote to memory of 1104	2784	Unicorn-52932.exe	40
PID 2784 wrote to memory of 1104	2784	Unicorn-52932.exe	40
PID 800 wrote to memory of 844	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	41
PID 800 wrote to memory of 844	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	41
PID 800 wrote to memory of 844	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	41
PID 800 wrote to memory of 844	800	70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe	41
PID 2364 wrote to memory of 1300	2364	Unicorn-950.exe	42
PID 2364 wrote to memory of 1300	2364	Unicorn-950.exe	42
PID 2364 wrote to memory of 1300	2364	Unicorn-950.exe	42
PID 2364 wrote to memory of 1300	2364	Unicorn-950.exe	42
PID 2696 wrote to memory of 2756	2696	Unicorn-38646.exe	43
PID 2696 wrote to memory of 2756	2696	Unicorn-38646.exe	43
PID 2696 wrote to memory of 2756	2696	Unicorn-38646.exe	43
PID 2696 wrote to memory of 2756	2696	Unicorn-38646.exe	43

C:\Users\Admin\AppData\Local\Temp\70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe
"C:\Users\Admin\AppData\Local\Temp\70a0dafa3e0894edb7eea94032ffd77b284457c136c76df679fa8a4211b9bba6N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-950.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41272.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41630.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4126.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exe
        9⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
        10⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        10⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        10⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        9⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        9⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        9⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        9⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        8⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        9⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        9⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        9⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        8⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        8⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe
        8⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        8⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31789.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22058.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28631.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
        8⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        8⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        8⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        8⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10846.exe
        7⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe
        7⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        7⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        7⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28802.exe
        6⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33658.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
        8⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        8⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        7⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18251.exe
        6⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        7⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
        6⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        6⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6207.exe
        7⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        7⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        6⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        6⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        6⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2699.exe
        6⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
        5⤵
        
        PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34479.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38257.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50758.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21423.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35180.exe
        8⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        8⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        8⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63939.exe
        7⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20928.exe
        7⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        7⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46674.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6207.exe
        7⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe
        7⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        6⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55382.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        6⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
        6⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe
        7⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        7⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4406.exe
        6⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33465.exe
        5⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
        6⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe
        5⤵
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46650.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
        6⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        7⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53734.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40700.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23866.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        6⤵
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
        5⤵
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        6⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        6⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61474.exe
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        5⤵
        
        PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46650.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
        5⤵
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
        6⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        6⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59492.exe
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10896.exe
        5⤵
        
        PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
      4⤵
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
        5⤵
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        5⤵
        
        PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
      4⤵
      PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46259.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55766.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        7⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
        6⤵
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        6⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
        6⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44116.exe
        7⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55743.exe
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49610.exe
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46109.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        6⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
        5⤵
        
        PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31987.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exe
        6⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
        7⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
        6⤵
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        6⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
        5⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39778.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15014.exe
        5⤵
        
        PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39778.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        6⤵
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
      4⤵
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        5⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
      4⤵
      PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
      4⤵
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
      4⤵
      PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54650.exe
        5⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        6⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        6⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        5⤵
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        5⤵
        
        PID:680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        5⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27199.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25724.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31011.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        5⤵
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8181.exe
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27152.exe
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11034.exe
      4⤵
      PID:6240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58734.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38117.exe
        5⤵
        
        PID:2468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 244
        6⤵
        Program crash
        
        PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
        5⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        6⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
      4⤵
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23136.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26033.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        5⤵
        
        PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exe
      4⤵
      PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
      4⤵
      PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8760.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        5⤵
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
      4⤵
      PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
      4⤵
      PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27918.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
      4⤵
      PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe
    3⤵
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41593.exe
    3⤵
    PID:3372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28682.exe
    3⤵
    PID:4652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9899.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52932.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52932.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5973.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14307.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38506.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        6⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        7⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4406.exe
        6⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        6⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44628.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exe
        6⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20673.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        6⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39439.exe
        5⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        6⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
      4⤵
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35185.exe
      4⤵
      PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46058.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63716.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exe
      4⤵
      PID:7008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
        6⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13469.exe
        7⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe
        7⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10896.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11427.exe
        5⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46877.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15956.exe
        6⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36410.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27235.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
        5⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44443.exe
        6⤵
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        5⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26257.exe
      4⤵
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60125.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38674.exe
      4⤵
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4168.exe
      4⤵
      PID:6796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        5⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7665.exe
      4⤵
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1022.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
      4⤵
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
        5⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38271.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        6⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23035.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        5⤵
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
      4⤵
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53901.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
      4⤵
      PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
      4⤵
      PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58159.exe
    3⤵
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29421.exe
      4⤵
      PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40700.exe
      4⤵
      PID:6220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
    3⤵
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
    3⤵
    PID:6152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14748.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        5⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        5⤵
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7503.exe
      4⤵
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        5⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2921.exe
        5⤵
        
        PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
      4⤵
      PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        5⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53362.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        6⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23035.exe
        5⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        5⤵
        
        PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
      4⤵
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
      4⤵
      PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
      4⤵
      PID:6080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32388.exe
      4⤵
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39778.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        5⤵
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48693.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
      4⤵
      PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
      4⤵
      PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
      4⤵
      PID:6400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20323.exe
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
    3⤵
    PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
    3⤵
    PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17405.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17405.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58734.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
        5⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58380.exe
        6⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
        5⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
      4⤵
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        5⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
      4⤵
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
      4⤵
      PID:7156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe
      4⤵
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
      4⤵
      PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
    3⤵
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
      4⤵
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
      4⤵
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
    3⤵
    PID:4244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5810.exe
    3⤵
    PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
    3⤵
    PID:6252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26394.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26394.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
      4⤵
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        6⤵
        
        PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64126.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3067.exe
      4⤵
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16977.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40700.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54260.exe
      4⤵
      PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
      4⤵
      PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
      4⤵
      PID:6968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19346.exe
    3⤵
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21989.exe
      4⤵
      PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      4⤵
      PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
    3⤵
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
    3⤵
    PID:5164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
    3⤵
    PID:5604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39537.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39537.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
    3⤵
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52969.exe
      4⤵
      PID:352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
      4⤵
      PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
      4⤵
      PID:6836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62460.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
    3⤵
    PID:4056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
    3⤵
    PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
    3⤵
    PID:6444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
  2⤵
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
    3⤵
    PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
    3⤵
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
    3⤵
    PID:6160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe
  2⤵
  PID:3420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
  2⤵
  PID:1616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47700.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47700.exe
  2⤵
  PID:6272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe

Filesize
468KB

MD5
c460a038cb8fbb5b2ee3de5168fe6ee5

SHA1
efd30ea1215f67bb3ee1369dc8ace5424de27de3

SHA256
1932789e3d87a01c0e4ee9d1f22c7d79477917948aaea8799786870182c81d4a

SHA512
7330a72b26409f26e547ca6f581f43fe7760361903865a5f69de5512f24982e3e95c162bce932f1ba7674fb777553b5a883eff3aa38ea07688208edd00ea661f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe

Filesize
468KB

MD5
daced17e9266fd05114bcef2fbfbddb3

SHA1
f7caa032a3857734680de8c11fdd41d17ffe966f

SHA256
b2f01c96167690d7f1954ca8c05c3fba6f055aa0c6d6583dc0a57adafed4e90c

SHA512
934469cbecf7a33a7069f92767f581ee86021eb3b3920d21a3128cd9c9815bbe7d11916c65f8a6525e4f002e130860558f8eb773bb513961724e72e15a05a97d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe

Filesize
468KB

MD5
87c02f2e473358d9f77f3ef8bfef6a66

SHA1
e8be3f84049fe6a84655d18cd2f74a77eb545282

SHA256
f9625b66e295238d6aa48808e24d4c3275928b4dbee52292c11e774f16cf6cb6

SHA512
133f0885edbe595d1ab8451ca1a22f271f5e93a3a980320e64fc60b20c22bb8255b4bb8c647b22069d8d84ca8ad4c8756fad23cb22564435111c326b96fb8355

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe

Filesize
468KB

MD5
917dacaaf9f3c806939efb66301ac2f1

SHA1
55a0c6b8c30e91766a98d4e74c1001363874a517

SHA256
8b7ef397707b25b02dbca830ec5ada01a3aa2ba05d4cdb6b4b1fa7cbe713f4e9

SHA512
c46277b0f8c34280b56ebb89431f3380f6da8899315402769eb66b0b03cdce809f52549b220dca94bcfc9d76ada7653a8b6cd3e9f94adbfa6209e1f773fda9c8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14307.exe

Filesize
468KB

MD5
fc686cde8e49fb910fd85866b547f0e2

SHA1
6a4f94fd8ccb94ca374a803b287f3694e372131a

SHA256
46d99fa73a817acc25cbebf4e838ef38102fe3d59f759042db93034e68aa286b

SHA512
366c8f88dce471557fd59a3330cb3bf2bf32ab157dc29a33cc22d9f1d9c4e257dc90a322da043874932624e6c92a967a5df7f118d132b1d79d73e5af1938ac70

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17405.exe

Filesize
468KB

MD5
71c3bd7ec0987c56e7ca0f784a9d4b77

SHA1
249f43aa86206e1bad72f060b38449b2070bbf18

SHA256
f82077d73412233dcc0b6ad20efbeb245006febc215fbaccb74936d5fdc6276b

SHA512
0e431214d4d45ca528fe1c43d3e8f63e65e50196db0f8c3c797c15cb44102a3eefe72f62f6014a9caf4fce135ad314b510439e3fa547b77fa22eee393bff037d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe

Filesize
468KB

MD5
6a4b7a25bd1f0c7b76a4a35767a8561e

SHA1
a4b665b825ce1a77d3d2b6c09d4056bdea53b719

SHA256
7f05cb418999c5a038972d1df23b75c07d4740f0a02a6f0ae5fc9b5b436940ab

SHA512
4f6c38c6674b61d6a87afae50d9c93787f84a795dbab53a4038ebcea8a0f666c54a06992edf2e28d69a2098599dfefdb7bc7ee696868b02c7a8fc2dec8bfed31

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe

Filesize
468KB

MD5
43eba7991cdcc805d5707733db5e09da

SHA1
93ad19c3a721828519f083dac810bef219f27a22

SHA256
ed77653508fe250285d7c6b30ed2d570288be20b9b0a81ef7cb21f42e3b9d14c

SHA512
47f7d0aa367f15fac30bfc301f63c7b0a59d4e58b992cc84fc87cb60615f5e45b0378d8fd3f538f276814b7c11e081cc38c210d1d3cb508f4648253e1e0663c0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33658.exe

Filesize
468KB

MD5
e79c91425740b6eedf6d475c13213af0

SHA1
8b4865a4880f9aa20772d74b3601a08a15188ab4

SHA256
e04e96bbc7ac7e19e2c537ae3d75d160c2df1dd2603a98c6fc16428110843dcc

SHA512
930343189b3642ddc2d21a20c7384242d4f6ae502a63c682aab76b5ebe026cc84c008fc97cb74d0cb91356af165b69d4df49e360fa8cc4d689ff07a2ac8b4c5a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38257.exe

Filesize
468KB

MD5
4b91fb3239154983b467b7b7c4ca9ca2

SHA1
c07592190b2e9dac018fc746ed871e0034590ffd

SHA256
c55153a2c959011a6a047e0a392a407de8c97274cbb1968560209fc0efc33b62

SHA512
a886e1e6649715f7dae61356a6bed097f8761b65b894ce442deb337b18333b959ff83c73c17ad87e45f8d71e22050f475cd1954265dc01abce62bdd275c097f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe

Filesize
468KB

MD5
7e851e05b573215c395440f13ac6f99c

SHA1
9b25624b49bbaa9108c017c1f25b0bb3748a7ce7

SHA256
972723accee0666998a01ed20f4c894c53fea69c3a9e7b9c0b3f28028c956652

SHA512
094bddbb1c6ad37701067870b66f3f4cc2cb7532e9cf404104485d8928828bd4287541eb5c696d99b21446dfd2aa0aeaea0702703815c1375dfdc0db1cbbd85b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41272.exe

Filesize
468KB

MD5
313477238fadbdf12fc3dc0630ce401f

SHA1
f115ccf1151fd4fb19b90a0f26954aee7f5cf9d9

SHA256
0736dcecc871334248ff7265d5f0044a67c1633ad942b7889d30ad7c9f45e51b

SHA512
f9b0e5a945ef5888e4078552dde8d3aa2997fdb0c2abeb2f8ce9980a82eac8e11a3c0bfd162f564fa7a7ff04a7b6af4a34131570fd60c66d0109ceb68c5e4103

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46259.exe

Filesize
468KB

MD5
71348eb3a396c2f7b79dba7dc38f5873

SHA1
d8a5fd767ddf36ce16eb7dc3dc544c1aebddceb3

SHA256
14294465da3fb804e439ffcc09abad0c8257843a9c2918ecea4a101af45073ed

SHA512
c9702abe7dcb9283cd1f64ca0cfb5de470b8a76e1e68925d268685284aacc671a422bd27a6ecc93dc279501e05a5b273ebe234a024838af2a863641ce4cdf9b5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe

Filesize
468KB

MD5
490acf734614ad7e6f28bea81264529f

SHA1
3de7974cd1494ae2f97cc7ef3f77fff28dd2d88c

SHA256
2287e87f7a94193c1d16517b967ef600376420b00ece29a175f00f0468f865fd

SHA512
f726982a07b1aaf94e6d24980a279742180b5b5afb30c2b72b0a63a0e5bff4597b9bdcc0f84d20df1b496355a63eec3170edea3b2df84f7986037ef9b8ad7b9f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52932.exe

Filesize
468KB

MD5
ebef8b1eb5f84d09214ace6dd7ec0ef1

SHA1
04e48f1cdc027d9791244c8e828235f929317567

SHA256
76ac7d820cac95de06718d5b92c808716509cd4c2f325b098f098022295ace40

SHA512
8600d25e26df0a47f7036e96a95e968151f7ae415ffe248262a690efd05a1ac2b018ee2d027d325d51b053a4f381507225afad200d66f897f7c03dfd08017140

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe

Filesize
468KB

MD5
f463468c43d4a5930d9ffad7e1f4cdcd

SHA1
0ada8383f84cf0d9d100499f99a374b2a35dc940

SHA256
d5a3ce511c74c38fb2696362897e7c92d774b5c2b14fc62ad4ae75c1ab3d048b

SHA512
868c53c1dcaef859df422caa981eb4f04cd6dc21d7474dee0a023df43f6b6738c56adffa2de8a7f63645b7b5c6555a6d0e2a0bee3183965dfb8c86ed8ce2c775

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5973.exe

Filesize
468KB

MD5
f72a3550f7fcbff893dbbc9fe48d1cd8

SHA1
aae484e072288656ef7359131b5f4549135e024e

SHA256
0f2c1e95cdd4699c8d28134af059cdddf620ae421b4af8e5590fcd5aca3893ca

SHA512
62bd4693f1f50b4ca618b5e88f0a7326da86cd7626204561eb16512b3071f1f9b90165384ca08d64cec5531f40d135fa8010e1f5785b86521275733ff834d1ab

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe

Filesize
468KB

MD5
908d747fcfbd27efa77308d4cfa35013

SHA1
937c6dcc88355fdd9450559eca96d3ecc8c7a824

SHA256
5a4a3f634f347d96fe8b74137428fe8c72ae9aa045edf9c94de8c0e654f80951

SHA512
0d3b545010fc620ec434c67747ff7676e63805b93a7ad41ed4686f23c86c209336a1494dfc11a58775a8d3ad6c1aa42a471a8566c3c66c067c99e59aa5286ee1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-950.exe

Filesize
468KB

MD5
6a6651d8ed6db2920e57d819cc20e15e

SHA1
6ef6c1c25c0bd7fe0fcce0c64290efc0fa042fb2

SHA256
d9d87de8712b861b196c9faf26bca47f79a38c6a00d8ef2934b28573872637ae

SHA512
a893be97bde709f05787349adf05e033b680d897a3252886bf09569ec77ddb097fcc30565f94a90a27ccc06456740d42e462ffb51b135c326d97a306aca66ce5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe

Filesize
468KB

MD5
6e4d2dca6ef03a364c9ee4dd69663d16

SHA1
4d55a62b06bd6bb16b32271bf6f48370d1fc64f0

SHA256
7978efa7661921c1c8ae90c4058de5cba1c906b672f44ac4da6a99a5493ebf00

SHA512
2c597fffbd4b0939826c95515078df5f4620490261a57a71f12436a9bf36b0b527160a36aa8a95d99c9f9cdce0e56a366c718ca7e28c567413e72ad3fd8e772d

Download Submit