6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23deb

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
Size

468KB
MD5

0243fd7e22b1cf73c94d2b701e992310
SHA1

a8e495df86a8a4cbe175597b36534464d22d73a7
SHA256

6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23deb
SHA512

7ecc7430dc31830334fe463c6a651c23016c8cf7adfe11aca06964db9611d813ba4febab507bdb0ea11156e7c5e0174445bfc4445cc6154ebb4607969f3f18d0
SSDEEP

3072:VETDogIdI35YqbYaPzUTffC/gCHCGOphJEHhoVO4ipGL2IqVHilc:VEPowJYq5PATffqegsipIXqVH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2016	Unicorn-43952.exe
2372	Unicorn-40634.exe
1988	Unicorn-53017.exe
2756	Unicorn-26673.exe
2808	Unicorn-65484.exe
3048	Unicorn-45619.exe
2844	Unicorn-34003.exe
2612	Unicorn-26392.exe
2312	Unicorn-49089.exe
2336	Unicorn-45598.exe
2960	Unicorn-32417.exe
1628	Unicorn-12551.exe
2876	Unicorn-21927.exe
2864	Unicorn-21661.exe
628	Unicorn-2061.exe
532	Unicorn-23187.exe
2252	Unicorn-31219.exe
2172	Unicorn-57110.exe
1840	Unicorn-40316.exe
2588	Unicorn-23639.exe
1288	Unicorn-25922.exe
948	Unicorn-44500.exe
636	Unicorn-27182.exe
1308	Unicorn-47048.exe
1992	Unicorn-26353.exe
912	Unicorn-9798.exe
328	Unicorn-29664.exe
2284	Unicorn-32225.exe
2384	Unicorn-38356.exe
1500	Unicorn-26605.exe
1772	Unicorn-22050.exe
2476	Unicorn-22438.exe
2348	Unicorn-42304.exe
1964	Unicorn-26067.exe
1620	Unicorn-30501.exe
2468	Unicorn-45363.exe
2472	Unicorn-16713.exe
2816	Unicorn-49882.exe
2280	Unicorn-64704.exe
2932	Unicorn-39218.exe
2892	Unicorn-44606.exe
2904	Unicorn-40938.exe
2664	Unicorn-24740.exe
2728	Unicorn-30787.exe
2248	Unicorn-36141.exe
2708	Unicorn-41534.exe
3000	Unicorn-41534.exe
1640	Unicorn-28597.exe
1928	Unicorn-2094.exe
1364	Unicorn-15000.exe
2496	Unicorn-59218.exe
1440	Unicorn-65348.exe
1696	Unicorn-52411.exe
596	Unicorn-61980.exe
876	Unicorn-16309.exe
1412	Unicorn-46291.exe
576	Unicorn-27190.exe
848	Unicorn-47056.exe
1532	Unicorn-20170.exe
2020	Unicorn-14039.exe
1456	Unicorn-23626.exe
904	Unicorn-32545.exe
2484	Unicorn-39430.exe
1672	Unicorn-48030.exe

Loads dropped DLL 64 IoCs

pid	Process
2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
2016	Unicorn-43952.exe
2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
2016	Unicorn-43952.exe
1988	Unicorn-53017.exe
1988	Unicorn-53017.exe
2372	Unicorn-40634.exe
2372	Unicorn-40634.exe
2016	Unicorn-43952.exe
2016	Unicorn-43952.exe
2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
3048	Unicorn-45619.exe
3048	Unicorn-45619.exe
2016	Unicorn-43952.exe
2016	Unicorn-43952.exe
2756	Unicorn-26673.exe
2756	Unicorn-26673.exe
1988	Unicorn-53017.exe
2808	Unicorn-65484.exe
1988	Unicorn-53017.exe
2808	Unicorn-65484.exe
2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
2844	Unicorn-34003.exe
2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
2844	Unicorn-34003.exe
2372	Unicorn-40634.exe
2372	Unicorn-40634.exe
2612	Unicorn-26392.exe
2612	Unicorn-26392.exe
3048	Unicorn-45619.exe
3048	Unicorn-45619.exe
2336	Unicorn-45598.exe
2336	Unicorn-45598.exe
2756	Unicorn-26673.exe
2756	Unicorn-26673.exe
2312	Unicorn-49089.exe
2312	Unicorn-49089.exe
2016	Unicorn-43952.exe
2876	Unicorn-21927.exe
2876	Unicorn-21927.exe
2016	Unicorn-43952.exe
2844	Unicorn-34003.exe
2844	Unicorn-34003.exe
2864	Unicorn-21661.exe
2864	Unicorn-21661.exe
2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
2808	Unicorn-65484.exe
1628	Unicorn-12551.exe
2808	Unicorn-65484.exe
1628	Unicorn-12551.exe
1988	Unicorn-53017.exe
628	Unicorn-2061.exe
1988	Unicorn-53017.exe
628	Unicorn-2061.exe
2372	Unicorn-40634.exe
2372	Unicorn-40634.exe
532	Unicorn-23187.exe
532	Unicorn-23187.exe
2252	Unicorn-31219.exe
2612	Unicorn-26392.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	1640	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12551.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
2016	Unicorn-43952.exe
1988	Unicorn-53017.exe
2372	Unicorn-40634.exe
2756	Unicorn-26673.exe
3048	Unicorn-45619.exe
2844	Unicorn-34003.exe
2808	Unicorn-65484.exe
2612	Unicorn-26392.exe
2312	Unicorn-49089.exe
2336	Unicorn-45598.exe
2960	Unicorn-32417.exe
2864	Unicorn-21661.exe
2876	Unicorn-21927.exe
1628	Unicorn-12551.exe
628	Unicorn-2061.exe
532	Unicorn-23187.exe
2252	Unicorn-31219.exe
2172	Unicorn-57110.exe
1840	Unicorn-40316.exe
2588	Unicorn-23639.exe
1288	Unicorn-25922.exe
636	Unicorn-27182.exe
948	Unicorn-44500.exe
1308	Unicorn-47048.exe
1992	Unicorn-26353.exe
912	Unicorn-9798.exe
328	Unicorn-29664.exe
2384	Unicorn-38356.exe
2284	Unicorn-32225.exe
1500	Unicorn-26605.exe
1772	Unicorn-22050.exe
2476	Unicorn-22438.exe
2348	Unicorn-42304.exe
1964	Unicorn-26067.exe
1620	Unicorn-30501.exe
2468	Unicorn-45363.exe
2472	Unicorn-16713.exe
2816	Unicorn-49882.exe
2280	Unicorn-64704.exe
2932	Unicorn-39218.exe
2892	Unicorn-44606.exe
2664	Unicorn-24740.exe
2904	Unicorn-40938.exe
2728	Unicorn-30787.exe
2248	Unicorn-36141.exe
3000	Unicorn-41534.exe
2708	Unicorn-41534.exe
1640	Unicorn-28597.exe
1928	Unicorn-2094.exe
1364	Unicorn-15000.exe
2496	Unicorn-59218.exe
1440	Unicorn-65348.exe
1696	Unicorn-52411.exe
876	Unicorn-16309.exe
596	Unicorn-61980.exe
1412	Unicorn-46291.exe
576	Unicorn-27190.exe
848	Unicorn-47056.exe
1532	Unicorn-20170.exe
2020	Unicorn-14039.exe
1456	Unicorn-23626.exe
904	Unicorn-32545.exe
2484	Unicorn-39430.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2016	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	30
PID 2536 wrote to memory of 2016	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	30
PID 2536 wrote to memory of 2016	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	30
PID 2536 wrote to memory of 2016	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	30
PID 2536 wrote to memory of 2372	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	32
PID 2536 wrote to memory of 2372	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	32
PID 2536 wrote to memory of 2372	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	32
PID 2536 wrote to memory of 2372	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	32
PID 2016 wrote to memory of 1988	2016	Unicorn-43952.exe	31
PID 2016 wrote to memory of 1988	2016	Unicorn-43952.exe	31
PID 2016 wrote to memory of 1988	2016	Unicorn-43952.exe	31
PID 2016 wrote to memory of 1988	2016	Unicorn-43952.exe	31
PID 1988 wrote to memory of 2756	1988	Unicorn-53017.exe	33
PID 1988 wrote to memory of 2756	1988	Unicorn-53017.exe	33
PID 1988 wrote to memory of 2756	1988	Unicorn-53017.exe	33
PID 1988 wrote to memory of 2756	1988	Unicorn-53017.exe	33
PID 2372 wrote to memory of 2808	2372	Unicorn-40634.exe	34
PID 2372 wrote to memory of 2808	2372	Unicorn-40634.exe	34
PID 2372 wrote to memory of 2808	2372	Unicorn-40634.exe	34
PID 2372 wrote to memory of 2808	2372	Unicorn-40634.exe	34
PID 2016 wrote to memory of 3048	2016	Unicorn-43952.exe	35
PID 2016 wrote to memory of 3048	2016	Unicorn-43952.exe	35
PID 2016 wrote to memory of 3048	2016	Unicorn-43952.exe	35
PID 2016 wrote to memory of 3048	2016	Unicorn-43952.exe	35
PID 2536 wrote to memory of 2844	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	36
PID 2536 wrote to memory of 2844	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	36
PID 2536 wrote to memory of 2844	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	36
PID 2536 wrote to memory of 2844	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	36
PID 3048 wrote to memory of 2612	3048	Unicorn-45619.exe	37
PID 3048 wrote to memory of 2612	3048	Unicorn-45619.exe	37
PID 3048 wrote to memory of 2612	3048	Unicorn-45619.exe	37
PID 3048 wrote to memory of 2612	3048	Unicorn-45619.exe	37
PID 2016 wrote to memory of 2312	2016	Unicorn-43952.exe	38
PID 2016 wrote to memory of 2312	2016	Unicorn-43952.exe	38
PID 2016 wrote to memory of 2312	2016	Unicorn-43952.exe	38
PID 2016 wrote to memory of 2312	2016	Unicorn-43952.exe	38
PID 2756 wrote to memory of 2336	2756	Unicorn-26673.exe	39
PID 2756 wrote to memory of 2336	2756	Unicorn-26673.exe	39
PID 2756 wrote to memory of 2336	2756	Unicorn-26673.exe	39
PID 2756 wrote to memory of 2336	2756	Unicorn-26673.exe	39
PID 1988 wrote to memory of 1628	1988	Unicorn-53017.exe	41
PID 1988 wrote to memory of 1628	1988	Unicorn-53017.exe	41
PID 1988 wrote to memory of 1628	1988	Unicorn-53017.exe	41
PID 1988 wrote to memory of 1628	1988	Unicorn-53017.exe	41
PID 2808 wrote to memory of 2960	2808	Unicorn-65484.exe	40
PID 2808 wrote to memory of 2960	2808	Unicorn-65484.exe	40
PID 2808 wrote to memory of 2960	2808	Unicorn-65484.exe	40
PID 2808 wrote to memory of 2960	2808	Unicorn-65484.exe	40
PID 2536 wrote to memory of 2864	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	42
PID 2536 wrote to memory of 2864	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	42
PID 2536 wrote to memory of 2864	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	42
PID 2536 wrote to memory of 2864	2536	6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe	42
PID 2844 wrote to memory of 2876	2844	Unicorn-34003.exe	43
PID 2844 wrote to memory of 2876	2844	Unicorn-34003.exe	43
PID 2844 wrote to memory of 2876	2844	Unicorn-34003.exe	43
PID 2844 wrote to memory of 2876	2844	Unicorn-34003.exe	43
PID 2372 wrote to memory of 628	2372	Unicorn-40634.exe	44
PID 2372 wrote to memory of 628	2372	Unicorn-40634.exe	44
PID 2372 wrote to memory of 628	2372	Unicorn-40634.exe	44
PID 2372 wrote to memory of 628	2372	Unicorn-40634.exe	44
PID 2612 wrote to memory of 532	2612	Unicorn-26392.exe	46
PID 2612 wrote to memory of 532	2612	Unicorn-26392.exe	46
PID 2612 wrote to memory of 532	2612	Unicorn-26392.exe	46
PID 2612 wrote to memory of 532	2612	Unicorn-26392.exe	46

C:\Users\Admin\AppData\Local\Temp\6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe
"C:\Users\Admin\AppData\Local\Temp\6440dbb210225809ef8cc3ad9fbccbeb8b8a97fff2187bde31377005b8c23debN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43952.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43952.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26673.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45598.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe
        8⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
        9⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        9⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        9⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7854.exe
        8⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
        7⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        8⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        8⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        7⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        7⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        8⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        8⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        8⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        7⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8893.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7431.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        7⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32446.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34345.exe
        6⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40316.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16713.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        8⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54543.exe
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        8⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30460.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2465.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44434.exe
        7⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45734.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        7⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18781.exe
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10088.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40788.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22903.exe
        6⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        6⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15137.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        7⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
        6⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33643.exe
        5⤵
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        6⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        7⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39666.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30724.exe
        5⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2529.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55129.exe
        5⤵
        
        PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29664.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        7⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
        8⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        8⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
        8⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        8⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17523.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        7⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        6⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29322.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
        7⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36141.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        6⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14317.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57859.exe
        5⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24109.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49035.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
        5⤵
        
        PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32225.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        6⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        7⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        7⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        7⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        6⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32431.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16203.exe
        5⤵
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        5⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40836.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        5⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
        5⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        5⤵
        
        PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61059.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10915.exe
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
      4⤵
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe
      4⤵
      PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32545.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        8⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        8⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        7⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        7⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        7⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        7⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        7⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        6⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
        6⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        7⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        7⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38385.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6186.exe
        5⤵
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        5⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22622.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25134.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31219.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14999.exe
        6⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46720.exe
        7⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        6⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        5⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        6⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55950.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32431.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        5⤵
        
        PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63989.exe
        5⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        6⤵
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45620.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
      4⤵
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        5⤵
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        5⤵
        
        PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
      4⤵
      PID:108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
      4⤵
      PID:5548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49089.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23639.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        7⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        7⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
        7⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        7⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        7⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        6⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16037.exe
        5⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20130.exe
        6⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        5⤵
        
        PID:608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        5⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
        5⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        6⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        6⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
        5⤵
        
        PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        5⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        5⤵
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
      4⤵
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34533.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
      4⤵
      PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16203.exe
      4⤵
      PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44606.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35903.exe
        5⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        5⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54688.exe
      4⤵
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        5⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55950.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe
      4⤵
      PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
      4⤵
      PID:6224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40938.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
      4⤵
      PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
    3⤵
    PID:336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23152.exe
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe
    3⤵
    PID:6684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32417.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        6⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61828.exe
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65093.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5346.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11370.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47056.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
        6⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        7⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe
        6⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60786.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        5⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        6⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
        5⤵
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14039.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25216.exe
      4⤵
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        5⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
        5⤵
        
        PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7097.exe
      4⤵
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32446.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34345.exe
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2061.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59199.exe
        7⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        5⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9342.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
        5⤵
        
        PID:476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
      4⤵
      PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
      4⤵
      PID:7120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        5⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7100.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4000.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17499.exe
      4⤵
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11130.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6703.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        5⤵
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
      4⤵
      PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
      4⤵
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
      4⤵
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      4⤵
      PID:6328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
    3⤵
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      4⤵
      PID:6516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23834.exe
    3⤵
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
    3⤵
    PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
    3⤵
    PID:6772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34003.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34003.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        6⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        7⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26828.exe
        5⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16424.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1376.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
        5⤵
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61980.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16182.exe
        5⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        5⤵
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
      4⤵
      PID:700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32431.exe
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
      4⤵
      PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 240
        5⤵
        Program crash
        
        PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3591.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
      4⤵
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59218.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
      4⤵
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      4⤵
      PID:6548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23506.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
      4⤵
      PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44176.exe
    3⤵
    PID:4612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11122.exe
    3⤵
    PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60209.exe
    3⤵
    PID:6708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47048.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54790.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        5⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26711.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
      4⤵
      PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
      4⤵
      PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
      4⤵
      PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
      4⤵
      PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
      4⤵
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
      4⤵
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9342.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1376.exe
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
      4⤵
      PID:6532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
    3⤵
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
      4⤵
      PID:6604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
    3⤵
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
    3⤵
    PID:2420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28392.exe
    3⤵
    PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
    3⤵
    PID:6844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26353.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26353.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52411.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
      4⤵
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        5⤵
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
      4⤵
      PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55130.exe
    3⤵
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
      4⤵
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
    3⤵
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33799.exe
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
    3⤵
    PID:5244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
    3⤵
    PID:6492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10570.exe
    3⤵
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
      4⤵
      PID:6168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
    3⤵
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8418.exe
    3⤵
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
    3⤵
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
    3⤵
    PID:5816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
    3⤵
    PID:6788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7864.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7864.exe
  2⤵
  PID:1332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
    3⤵
    PID:1128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
  2⤵
  PID:3476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
  2⤵
  PID:4588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
  2⤵
  PID:4788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
  2⤵
  PID:5708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe

Filesize
468KB

MD5
e1163edc39c8f346efc452afe113581d

SHA1
b98f3d0746ea7050b94236fcb3cbb8a52d660971

SHA256
48af6fd4396a958f7a7f35d6a60ac9eb4502be3fac9ecc626e947c87fad8d0cf

SHA512
7dabaab2b8d9b95fe04474725e8883ba029afbc3e0091de2b7f378a0eb4d232d3db1bd992b8b398373bd606957a41f8e1ad2aaf556c3cdfb6494c9fe82a9abe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe

Filesize
468KB

MD5
42b9e35e72d01079d91b62538972f9a4

SHA1
3bb1c8e2cab13022a26f7cd24bf11f3c3ee8db20

SHA256
55acfafc9e42847d265bf7d07a30a93d3192e674427bdbab501f976804903426

SHA512
6ba6757007d1d5964f9fb6f7e7bb2d947e00905975f34c3d4ce59c8242fa3547dd21116f7bde9d029df8ed13c1d8c229f1e007aaf47f5b5d2999744f83dd442a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31219.exe

Filesize
468KB

MD5
8905bef1114378a766e2e22964686b63

SHA1
7f377a2bab010369655d0e36563851e8f6d08c67

SHA256
a8b59aa80f17bcd00501c7cc0963a8a094c05cae07c8b9d35bf474336582ed87

SHA512
1480988e653c4efb1083a65b4d9d70b84ebfbda926df008462f6336e63877328d1b72b314c1ce41909189199b7d45e5f4f38be9f4a8e012cf24ce291bdf89649

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32417.exe

Filesize
468KB

MD5
4575429d3ed6eaab74fe02f3b52f43ac

SHA1
c0dec857c1431aeef7456e986fb3be8fa0021436

SHA256
1a5abf0403694b312fec641b657f310283901220a66a978bc759591b0b6661f7

SHA512
c8af264584c32014642eaeec37f2c9efbd33d98fdc38ae28886b9573472fc7f62739271c259029b4e1eaf8649ba7eb8a45e5ddfae1738eb17fbfb2a12674acba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe

Filesize
468KB

MD5
07fa3042e0dfcad24f0d21d651cfa9ac

SHA1
701ab298e598585d3ddefb00c3fbf15fb9549179

SHA256
8c99eda707ca0419745667052c26327c84fc8a0435d4b56a0777dd984841e63c

SHA512
3da8522198b5154be504952b54d2b91ab45b63fa924b4ab181d290f927a280dc5188d0eedd78ddfe1040b2a16bd60f1406536c2d752e964bfd8bdfd903499751

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe

Filesize
468KB

MD5
d84ebf932c7fc2942b5f7b57cf0065ba

SHA1
3b7449dd9f12d672033f0a068436e6b03324d11c

SHA256
163e80de7155bb17498e8fc0160ed1302214742d8bee12de6547efe3193c128d

SHA512
da3b6924cb485379cf8ad3e4c0d1c520e0eb002cc645526e8ab18000c94adfa4caa85f6a71b1437aee2b66bbd6730c06bc61d9e5ae31bf2e71ecabdedd66d043

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe

Filesize
468KB

MD5
9fb5aaaa6334ec9cd29938039bcf6aad

SHA1
0d4bfbd9aac1d568d567f2f3b32b371c337317c4

SHA256
731d1ea77a09dc376c1790a5e48cd72f5ff22c4caa4753e022a471cb7cff67ba

SHA512
fe6df74bde9383df565121d1c5e5032eaf56720e10ce407183efe0ebe8b02b5687132dd99506d7a22692c99d703e3904de4ac978f523e3e102b9111669af24a4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe

Filesize
468KB

MD5
7e20becddd201bc39a1a9581bddf942d

SHA1
f37365ae8fdea6ede5dc8547f00ec2cb636dc654

SHA256
34f70fe61cac65e3f63fc091a68c65a37808dc005aaa86808a6e975a45e990c0

SHA512
c48494ae85c1144755ffc5095082fa48ec5fe3eab34666ca10cf27e2aa06754680fd2b65a6a4adc2308b20b632cd17d39efc0da81eb9a62baa21da427e939680

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2061.exe

Filesize
468KB

MD5
5bfa9659737f2fcf14b75e278ef44784

SHA1
bcc485877c12f916aa97b50df98a24d9cd5b73b2

SHA256
e02d83484cec10a0d6804717023e9720d2d91dbf928bfeea755e44574496c814

SHA512
8e20127fa810e02acc83955ccaa9f267f3f1aca1dcfb98d84ed119b1a5e93195010f946bd81f4f4dc1ddf3a0a7d6093dd00667e7e34e282ec6b9310416018740

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe

Filesize
468KB

MD5
b569c04d5bd70892b44ee81d4e5ec03b

SHA1
8e135426c59a214170babf88cfc09ea65d619fb5

SHA256
c922acd11f7004c0f8596a533bf570e9aaa6b1e4e8b59c50755cf2d55090e56f

SHA512
4044348dcdff45fa4e3928734ae1ad4a30216e5aecc7fac3135f496a2bb2caee828e910cb1adb5e3bc8a4fde5c8b910e8b8cd1adb0326e80caa0e87103e9444c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe

Filesize
468KB

MD5
48e88f9c51e51bef27be113f40c5ee54

SHA1
2fed7ab79dc9b4ca823343c22ddb0a9c3cecf64d

SHA256
d51f23a753540cfbabe134790b73e9beaef7252a9d45b27b4e7be311f4cd456d

SHA512
116e805609c8aae48ac6cb63e48bb8604493e89d649f4c438f7c690bcb2212a9e4ba64cf96b73b5743b3363dac3ff56d65451376be02e29e763efb16a3132a4a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26673.exe

Filesize
468KB

MD5
d9c8c3a8d93ff7aece09bae91d511c76

SHA1
c8188abc437aeb50d922b8fa4e0dc7f827ceb717

SHA256
302d794b85da6db0e02199a01bfb19b3ef576f53b429c6fb96943075b1b0b871

SHA512
dcaaec6ef1577c7b42bfb9b899811a8b2b4d2869e10e99cca9719fd84f752204f6e5f380f7017a031ad8f1dede4bd1846676f368b704831a86b2c13ac3c1e11e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34003.exe

Filesize
468KB

MD5
88d71aabfdfa9fed2aecee446b3b91d0

SHA1
c369714b17bc0ced039307e42cfa3d5e2f42c487

SHA256
305dd2d9b2ecd9804e2acd2568aa85b06cd3ebd0c9c1036d30c86f3244c6193b

SHA512
5acca6b3cdc7977e1bad3b9363ed94ff7e0c73590a9a114d19865f8b2f47baf10876f847d2ed788048891d7a527b8f0b6ff110a5e58ee4c5066d606391c521fb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40316.exe

Filesize
468KB

MD5
8e9c83fc8aa5eae8430851f4cf4f5db2

SHA1
22192f3cc6a9285e4023856bda26c0342eea52b3

SHA256
a71f9d1e26daa098dd2b4a5ce551d6ebcab24c820deca3cda908d5adb676b26a

SHA512
c0f0f49b30125f55489f11a2df47606e2ae519615ebd871ca1b62fbf02d96168acc6469a760a2a8b1076518840dabda42b8ba7bc7b2035691450fd5b1d08536e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe

Filesize
468KB

MD5
79eadba28f0e0ca76a22c2aae41eb759

SHA1
ae8f195d99df64d09a0c095c8948c5a8215b0d8f

SHA256
0d282a1dd9fe91cb1f9fb2a24c0a8bedc9041f3d8f8e0bb40af634cbb07e6695

SHA512
61be654ed5bcae4e81e209f97421e00b7df08afb9eef5f526ec2ba3973379a20f72fb28e5d88a29e7dec7bfecd32a10dae1cf8fa96906faa929b1817d3e08234

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43952.exe

Filesize
468KB

MD5
dbce993a3a60572e0c9486d1d091d715

SHA1
22bd29caffb8da696528da6efc447a76deeb4407

SHA256
96412e657efb86c2f18da1a68560a8bf3a50cce6bdc1676509db2074b48258d7

SHA512
25c569cef8ba34739427852260f5bcdc593e58ce1b7537a406368b79438df4e37375544d5ea1231040222a5309b928fd3c63ed634729b0642cfe48b5c2aece0c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45598.exe

Filesize
468KB

MD5
8f6f39a7a54e87e9ad9d1e87383fbac4

SHA1
9f501b1cbd9862cf1c848d16ee198239d37ecd03

SHA256
ddbd36aa13cc3fcd25acf0020edac9480d8eb16f28bbc7f2f672c012b0d1ed03

SHA512
c1841224987aefa9af3f14762059fef5f249344c1fb0f61bce393d3e4a7ef09d8df36e20bb64ac692cac23009ea646ab8faf1e550627d194f706000a57c362b9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49089.exe

Filesize
468KB

MD5
65d56e851109ad91c4d64c1058fdf963

SHA1
7716dc63618925de5215eccfc911e2dd0ecde572

SHA256
b3d9e628b43e2bb90197a737bc64ceaa9d46e3a311035b0c8d2c13bce5456a13

SHA512
bdb4025108883d9ea740e7ae3868305ee72b04aa1a1c3ec13b453074da70468e4d40d692bf2eec041784a7b3290d2057c0c225281cd058f3b1ae92c86af8ecf6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe

Filesize
468KB

MD5
69647916436b16539141b4a5a96075f7

SHA1
9eb341731308d02b5f09796c8ca1ba43e69138f9

SHA256
56afc4336cee8515fa200dc2ca3f76a7d881a95633d4d9f8a472b10f919fa56a

SHA512
f86dc90732f71fdc019d3d42f7763a836c4f012d315ca718c773d89bff0f8fcb3bc1ae19f9bc1992e3b034d3d60dc47626910162aa2564a3ad6868707b0af68f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe

Filesize
468KB

MD5
270ee3ddee2527cbc2885c558d578842

SHA1
0ac67f759df12db3c843a5aa96abbe5eccbe1884

SHA256
99fa55ff99ec53158e82ea2047caa4f7c72dc6e2f8954dd3414e55f3ac91876e

SHA512
a5a6fc54894e78ef03cc8545257261875a516b5274630480272e4b72302a38f00bf3bad1839ac159af7beeb7c86119d0605b1c850136e8f63a235e088a534cdf

Download Submit