6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfd

Analysis

max time kernel
118s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
Size

468KB
MD5

67801b709fdf85a7b6bcb37cf59bda60
SHA1

ade302bfa5fe544ed2f14fd8d4ed200d4006073d
SHA256

6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfd
SHA512

e6f6ee3178d350dd7d6f7b89914910bcf8c9ada5d9da829577d9f134048e8a6081f8cc6ef7523506c8d521efe8b68f97b698b80f17d5a07b67f52d57ced93c0c
SSDEEP

3072:TSA1ogynI05ptbYnPz4Cef8/ECAvPgpXVmHe6Vs5CYiT2MiukIlT:TSCo88ptkPECefdcHRCY8Tiuk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2228	Unicorn-62585.exe
2800	Unicorn-60219.exe
1916	Unicorn-12393.exe
2972	Unicorn-35552.exe
2960	Unicorn-40648.exe
2556	Unicorn-34517.exe
2884	Unicorn-58743.exe
2104	Unicorn-62498.exe
3040	Unicorn-57493.exe
1576	Unicorn-60498.exe
1352	Unicorn-54878.exe
1928	Unicorn-13056.exe
2592	Unicorn-8080.exe
1924	Unicorn-2215.exe
2000	Unicorn-8345.exe
1012	Unicorn-14099.exe
2712	Unicorn-4522.exe
2940	Unicorn-34056.exe
448	Unicorn-39450.exe
2604	Unicorn-17501.exe
1604	Unicorn-10832.exe
672	Unicorn-56504.exe
1808	Unicorn-5212.exe
1816	Unicorn-20759.exe
1632	Unicorn-58985.exe
1540	Unicorn-16639.exe
2524	Unicorn-3212.exe
2512	Unicorn-3212.exe
1076	Unicorn-62619.exe
2140	Unicorn-59076.exe
1192	Unicorn-4474.exe
884	Unicorn-58625.exe
3008	Unicorn-46337.exe
1696	Unicorn-17779.exe
2528	Unicorn-8842.exe
2072	Unicorn-14972.exe
2904	Unicorn-5491.exe
2552	Unicorn-64721.exe
2352	Unicorn-55764.exe
2768	Unicorn-45028.exe
2640	Unicorn-22827.exe
2808	Unicorn-27857.exe
2264	Unicorn-17396.exe
2680	Unicorn-2546.exe
2156	Unicorn-14497.exe
1680	Unicorn-9142.exe
1640	Unicorn-34977.exe
1316	Unicorn-16904.exe
1520	Unicorn-40007.exe
1784	Unicorn-7853.exe
1932	Unicorn-27719.exe
2692	Unicorn-51734.exe
1268	Unicorn-57864.exe
792	Unicorn-24144.exe
2716	Unicorn-33145.exe
3012	Unicorn-26802.exe
2928	Unicorn-13850.exe
788	Unicorn-54816.exe
824	Unicorn-42528.exe
2012	Unicorn-21561.exe
2052	Unicorn-56176.exe
948	Unicorn-43836.exe
772	Unicorn-55691.exe
648	Unicorn-21607.exe

Loads dropped DLL 64 IoCs

pid	Process
2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
2228	Unicorn-62585.exe
2228	Unicorn-62585.exe
2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
1916	Unicorn-12393.exe
2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
2800	Unicorn-60219.exe
1916	Unicorn-12393.exe
2800	Unicorn-60219.exe
2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
2228	Unicorn-62585.exe
2228	Unicorn-62585.exe
2972	Unicorn-35552.exe
2972	Unicorn-35552.exe
1916	Unicorn-12393.exe
2960	Unicorn-40648.exe
1916	Unicorn-12393.exe
2960	Unicorn-40648.exe
2800	Unicorn-60219.exe
2884	Unicorn-58743.exe
2800	Unicorn-60219.exe
2884	Unicorn-58743.exe
2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
2556	Unicorn-34517.exe
2228	Unicorn-62585.exe
2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
2228	Unicorn-62585.exe
2556	Unicorn-34517.exe
2104	Unicorn-62498.exe
2104	Unicorn-62498.exe
2972	Unicorn-35552.exe
2972	Unicorn-35552.exe
3040	Unicorn-57493.exe
3040	Unicorn-57493.exe
1916	Unicorn-12393.exe
1916	Unicorn-12393.exe
1576	Unicorn-60498.exe
1576	Unicorn-60498.exe
1924	Unicorn-2215.exe
2960	Unicorn-40648.exe
1924	Unicorn-2215.exe
2960	Unicorn-40648.exe
2000	Unicorn-8345.exe
2000	Unicorn-8345.exe
2228	Unicorn-62585.exe
2228	Unicorn-62585.exe
1928	Unicorn-13056.exe
1928	Unicorn-13056.exe
2556	Unicorn-34517.exe
2556	Unicorn-34517.exe
1352	Unicorn-54878.exe
2592	Unicorn-8080.exe
2800	Unicorn-60219.exe
1352	Unicorn-54878.exe
2592	Unicorn-8080.exe
2800	Unicorn-60219.exe
2884	Unicorn-58743.exe
2884	Unicorn-58743.exe
2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
1012	Unicorn-14099.exe
1012	Unicorn-14099.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1420	2648	WerFault.exe	109
3236	2668	WerFault.exe	108

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13964.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
2228	Unicorn-62585.exe
1916	Unicorn-12393.exe
2800	Unicorn-60219.exe
2972	Unicorn-35552.exe
2960	Unicorn-40648.exe
2556	Unicorn-34517.exe
2884	Unicorn-58743.exe
2104	Unicorn-62498.exe
3040	Unicorn-57493.exe
1576	Unicorn-60498.exe
2000	Unicorn-8345.exe
1924	Unicorn-2215.exe
2592	Unicorn-8080.exe
1928	Unicorn-13056.exe
1352	Unicorn-54878.exe
1012	Unicorn-14099.exe
2712	Unicorn-4522.exe
2940	Unicorn-34056.exe
448	Unicorn-39450.exe
2604	Unicorn-17501.exe
1604	Unicorn-10832.exe
672	Unicorn-56504.exe
1808	Unicorn-5212.exe
1816	Unicorn-20759.exe
1632	Unicorn-58985.exe
2524	Unicorn-3212.exe
2512	Unicorn-3212.exe
1076	Unicorn-62619.exe
1540	Unicorn-16639.exe
2140	Unicorn-59076.exe
1192	Unicorn-4474.exe
884	Unicorn-58625.exe
3008	Unicorn-46337.exe
1696	Unicorn-17779.exe
2528	Unicorn-8842.exe
2072	Unicorn-14972.exe
2904	Unicorn-5491.exe
2552	Unicorn-64721.exe
2352	Unicorn-55764.exe
2768	Unicorn-45028.exe
2640	Unicorn-22827.exe
2808	Unicorn-27857.exe
2264	Unicorn-17396.exe
2680	Unicorn-2546.exe
2156	Unicorn-14497.exe
1680	Unicorn-9142.exe
1316	Unicorn-16904.exe
1640	Unicorn-34977.exe
1784	Unicorn-7853.exe
1520	Unicorn-40007.exe
2716	Unicorn-33145.exe
1932	Unicorn-27719.exe
2692	Unicorn-51734.exe
1268	Unicorn-57864.exe
792	Unicorn-24144.exe
3012	Unicorn-26802.exe
2928	Unicorn-13850.exe
788	Unicorn-54816.exe
824	Unicorn-42528.exe
2012	Unicorn-21561.exe
2052	Unicorn-56176.exe
948	Unicorn-43836.exe
772	Unicorn-55691.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2228	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	31
PID 2584 wrote to memory of 2228	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	31
PID 2584 wrote to memory of 2228	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	31
PID 2584 wrote to memory of 2228	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	31
PID 2228 wrote to memory of 2800	2228	Unicorn-62585.exe	32
PID 2228 wrote to memory of 2800	2228	Unicorn-62585.exe	32
PID 2228 wrote to memory of 2800	2228	Unicorn-62585.exe	32
PID 2228 wrote to memory of 2800	2228	Unicorn-62585.exe	32
PID 2584 wrote to memory of 1916	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	33
PID 2584 wrote to memory of 1916	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	33
PID 2584 wrote to memory of 1916	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	33
PID 2584 wrote to memory of 1916	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	33
PID 1916 wrote to memory of 2972	1916	Unicorn-12393.exe	34
PID 1916 wrote to memory of 2972	1916	Unicorn-12393.exe	34
PID 1916 wrote to memory of 2972	1916	Unicorn-12393.exe	34
PID 1916 wrote to memory of 2972	1916	Unicorn-12393.exe	34
PID 2800 wrote to memory of 2960	2800	Unicorn-60219.exe	36
PID 2800 wrote to memory of 2960	2800	Unicorn-60219.exe	36
PID 2800 wrote to memory of 2960	2800	Unicorn-60219.exe	36
PID 2800 wrote to memory of 2960	2800	Unicorn-60219.exe	36
PID 2584 wrote to memory of 2556	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	35
PID 2584 wrote to memory of 2556	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	35
PID 2584 wrote to memory of 2556	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	35
PID 2584 wrote to memory of 2556	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	35
PID 2228 wrote to memory of 2884	2228	Unicorn-62585.exe	37
PID 2228 wrote to memory of 2884	2228	Unicorn-62585.exe	37
PID 2228 wrote to memory of 2884	2228	Unicorn-62585.exe	37
PID 2228 wrote to memory of 2884	2228	Unicorn-62585.exe	37
PID 2972 wrote to memory of 2104	2972	Unicorn-35552.exe	38
PID 2972 wrote to memory of 2104	2972	Unicorn-35552.exe	38
PID 2972 wrote to memory of 2104	2972	Unicorn-35552.exe	38
PID 2972 wrote to memory of 2104	2972	Unicorn-35552.exe	38
PID 1916 wrote to memory of 3040	1916	Unicorn-12393.exe	39
PID 1916 wrote to memory of 3040	1916	Unicorn-12393.exe	39
PID 1916 wrote to memory of 3040	1916	Unicorn-12393.exe	39
PID 1916 wrote to memory of 3040	1916	Unicorn-12393.exe	39
PID 2960 wrote to memory of 1576	2960	Unicorn-40648.exe	40
PID 2960 wrote to memory of 1576	2960	Unicorn-40648.exe	40
PID 2960 wrote to memory of 1576	2960	Unicorn-40648.exe	40
PID 2960 wrote to memory of 1576	2960	Unicorn-40648.exe	40
PID 2800 wrote to memory of 1928	2800	Unicorn-60219.exe	41
PID 2800 wrote to memory of 1928	2800	Unicorn-60219.exe	41
PID 2800 wrote to memory of 1928	2800	Unicorn-60219.exe	41
PID 2800 wrote to memory of 1928	2800	Unicorn-60219.exe	41
PID 2884 wrote to memory of 1352	2884	Unicorn-58743.exe	42
PID 2884 wrote to memory of 1352	2884	Unicorn-58743.exe	42
PID 2884 wrote to memory of 1352	2884	Unicorn-58743.exe	42
PID 2884 wrote to memory of 1352	2884	Unicorn-58743.exe	42
PID 2584 wrote to memory of 2592	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	44
PID 2584 wrote to memory of 2592	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	44
PID 2584 wrote to memory of 2592	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	44
PID 2584 wrote to memory of 2592	2584	6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe	44
PID 2228 wrote to memory of 1924	2228	Unicorn-62585.exe	45
PID 2228 wrote to memory of 1924	2228	Unicorn-62585.exe	45
PID 2228 wrote to memory of 1924	2228	Unicorn-62585.exe	45
PID 2228 wrote to memory of 1924	2228	Unicorn-62585.exe	45
PID 2556 wrote to memory of 2000	2556	Unicorn-34517.exe	43
PID 2556 wrote to memory of 2000	2556	Unicorn-34517.exe	43
PID 2556 wrote to memory of 2000	2556	Unicorn-34517.exe	43
PID 2556 wrote to memory of 2000	2556	Unicorn-34517.exe	43
PID 2104 wrote to memory of 1012	2104	Unicorn-62498.exe	46
PID 2104 wrote to memory of 1012	2104	Unicorn-62498.exe	46
PID 2104 wrote to memory of 1012	2104	Unicorn-62498.exe	46
PID 2104 wrote to memory of 1012	2104	Unicorn-62498.exe	46

C:\Users\Admin\AppData\Local\Temp\6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe
"C:\Users\Admin\AppData\Local\Temp\6529fa99030e68442ddaaa3b9a350720a2fae81bd65159f5693a85ba3d1d7cfdN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60219.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40648.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17501.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24478.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        9⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56201.exe
        9⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        9⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
        9⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        8⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
        8⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        8⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        8⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        7⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25167.exe
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        8⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        7⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52818.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        7⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        7⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 240
        8⤵
        Program crash
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        7⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41555.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        6⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        7⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56018.exe
        6⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46937.exe
        7⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
        7⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21454.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30281.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        6⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56504.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27857.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65243.exe
        7⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        8⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        8⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        8⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        7⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exe
        6⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49179.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        7⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        7⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        7⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46379.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20598.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17396.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        6⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
        7⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
        5⤵
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50264.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39096.exe
        5⤵
        
        PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58985.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43836.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40158.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        7⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe
        6⤵
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55691.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        6⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        7⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        6⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
        5⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        5⤵
        
        PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        6⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        6⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25019.exe
        5⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        5⤵
        
        PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13850.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        5⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        5⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47353.exe
      4⤵
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        5⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22471.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
      4⤵
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe
      4⤵
      PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
      4⤵
      PID:7016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3212.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40458.exe
        7⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        8⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        8⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
        7⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56176.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28931.exe
        5⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40007.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        6⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21993.exe
        7⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33299.exe
        7⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36383.exe
        5⤵
        
        PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61527.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        5⤵
        
        PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55373.exe
        5⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40580.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30619.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48873.exe
      4⤵
      PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
      4⤵
      PID:5864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10832.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2546.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        6⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32140.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
        7⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        5⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        5⤵
        
        PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65243.exe
        5⤵
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35062.exe
        6⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        5⤵
        
        PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58613.exe
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
        5⤵
        
        PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4164.exe
      4⤵
      PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38490.exe
      4⤵
      PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54812.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
      4⤵
      PID:6640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3440.exe
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
      4⤵
      PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
      4⤵
      PID:6880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54709.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
    3⤵
    PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
    3⤵
    PID:5912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
    3⤵
    PID:7008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12393.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12393.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14099.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58625.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21607.exe
        7⤵
        Executes dropped EXE
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
        8⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        8⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        8⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-247.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53929.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        6⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59850.exe
        7⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56467.exe
        7⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25799.exe
        6⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        7⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
        7⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        7⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
        6⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39568.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12985.exe
        6⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43489.exe
        5⤵
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
        5⤵
        
        PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11866.exe
        6⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        5⤵
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        6⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        6⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57571.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        5⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40083.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59585.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10284.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30281.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
      4⤵
      PID:6376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57493.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exe
        6⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20668.exe
        7⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        7⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        5⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22094.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6011.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50220.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        6⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21696.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        5⤵
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        5⤵
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        6⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56201.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        5⤵
        
        PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        5⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
      4⤵
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        5⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25239.exe
      4⤵
      PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26819.exe
      4⤵
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
      4⤵
      PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
      4⤵
      PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        5⤵
        
        PID:2668
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 240
        6⤵
        Program crash
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        5⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49169.exe
      4⤵
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
      4⤵
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
      4⤵
      PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2430.exe
      4⤵
      PID:6596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55764.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exe
      4⤵
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        5⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13172.exe
        6⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31195.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35062.exe
        5⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        5⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
      4⤵
      PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10264.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65440.exe
    3⤵
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
      4⤵
      PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
      4⤵
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
      4⤵
      PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2129.exe
    3⤵
    PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8750.exe
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
    3⤵
    PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
    3⤵
    PID:7040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34517.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34517.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16904.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        6⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31286.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        7⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
        7⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        5⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        5⤵
        
        PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        5⤵
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57817.exe
      4⤵
      PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
      4⤵
      PID:7112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        5⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31413.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
      4⤵
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11573.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41807.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
      4⤵
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
      4⤵
      PID:6540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56018.exe
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21454.exe
    3⤵
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30281.exe
    3⤵
    PID:4648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
    3⤵
    PID:5452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
    3⤵
    PID:7064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3212.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
        5⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45371.exe
        5⤵
        
        PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61527.exe
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
      4⤵
      PID:7136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
      4⤵
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
        5⤵
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
      4⤵
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
      4⤵
      PID:6424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4181.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
    3⤵
    PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30281.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
    3⤵
    PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
    3⤵
    PID:6996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
      4⤵
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46937.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62947.exe
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9873.exe
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe
      4⤵
      PID:6448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
    3⤵
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18815.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
      4⤵
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
      4⤵
      PID:7032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47881.exe
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
    3⤵
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
    3⤵
    PID:4756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42085.exe
    3⤵
    PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54908.exe
    3⤵
    PID:7144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26802.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26802.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exe
    3⤵
    PID:1548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
    3⤵
    PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
    3⤵
    PID:6872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
  2⤵
  PID:336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33178.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33178.exe
  2⤵
  PID:3796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38415.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38415.exe
  2⤵
  PID:4200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
  2⤵
  PID:5948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12393.exe

Filesize
468KB

MD5
51b252dedc707980b2105ab2bad2f728

SHA1
87e87e86f0e32559f75e5defda594ebc98b0503d

SHA256
d78168c936cf9640ff8b572e1d44fa6f84fb0a92b9258fc8ff761f536dfb1e51

SHA512
3f319195f614b9d01b413a828e193f15fbaddaa5bd85fbb5a2620498fe9825abe001a395b49d4894b561442d12f4658fd5abf6d36c9bb1a63d47e431a9eae6ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe

Filesize
468KB

MD5
6723b73a2c55bf395b49b490f82f315b

SHA1
8a74ef84592d64b3b3f401a9fad5138d26823282

SHA256
1dfd336f1e5d543948e35b25f8bb5e8641bfd0c8e5f59720cf3ff1891ec134be

SHA512
89938945e5c05a152589fa4dd553f9481b88ef5d288e711203ae3bcaa193a669c0956245e196757bcb55591fe39ec2f2c5e3516ad57a4382ea1273e94964bf99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe

Filesize
468KB

MD5
ea6545e41fb6837a5b43293200ed1381

SHA1
7e0e82ef57bfa1d772c90d9860b1e9691938e8a2

SHA256
13462463260da62c55c1dac1fe9876c18b4ce4646604f728b18f0836a71cceef

SHA512
3b4fc703e3689e6ac8c8afc2ed41649713425974025d203522fe46085006237f2653156d5b4fceeabe6a479e437cc612884b0989b23ea0f7d98a279281f6660f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42085.exe

Filesize
468KB

MD5
c99bb2203ad67363995e8bd54bdf5b01

SHA1
d06d260070380f62283d33d60bb1fef58d86e4c7

SHA256
aae7ab0471181c5b0498380efa9fc28b62e963d1fa28ff084963b2984bbd31bd

SHA512
bde56eddfd69917feddda3ea4616ee3385ffce9a7450fd4c1ecf4caa207a96584144dc8a7f780e19ede8a6f7be64b17b8ed5072c1ceffdd81bbcd566186b93d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe

Filesize
468KB

MD5
552080d0a3f2aae5ad9ebc61cb609d5c

SHA1
99ca582f5be8b937ac88a00be758c8c7f31009b1

SHA256
afee2aa0185f38a80dbfbc875160c2d0a3416c5d546bab44acc70ea006b89a8f

SHA512
0a52a9f68d8aaeacde9ec1d98c0971341855028359d1cdbc00c7b847a18cea34c05a5375d9061a9a4bc57d45ceeb312f6b5eed266499e4a0e18850632f131de7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe

Filesize
468KB

MD5
fc8bb7d38ac91528fda4d504555f7b96

SHA1
62fa846f240fd322d3e57c0ce89743a65b5b96a1

SHA256
18ada30d69a0a76612d912957abf36b8ea3ed83104b8155bf91a8212bb83e023

SHA512
649e44f185aaa361e36de8b05027b22f06dbcbebb153f8ee742a8308a1d5579193c682901aa327c676cdf7e96f1e11a918ef370c2492423c21fb4b82b6cca12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe

Filesize
468KB

MD5
f61bc370c3d819ad227f688f4157d554

SHA1
2ac50e5f9012a3e223cbe49178122e45e9c2be51

SHA256
f40560317daed547349d02736ffe586ec519bb7ed4c4bd49b75cfc3de19c6b2f

SHA512
636bca6002638c36682e01c68c600ef5412a772903687297ed36fc872910415e2e24afafdd4bc33400dab2d821d0d0e869f0db766838e9e223c3c3907dddba03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe

Filesize
468KB

MD5
e0da21501dafaedbc06aa53a8bd26f44

SHA1
2ebdcb0c0702d3ba752a8dbdba1894759dca011d

SHA256
2de03370d85c4b9a786006057db8c7f4a8d1ba9a2b019dd579493f989eda5ee5

SHA512
256b4aa63ac52d2c98994f4d29623e70ffc4d3f86b20a10211bb0baf69a89083ab85edb34793ab932d18729101e8ea00f4ac2e2471696fdf4eccb2fcf5681372

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13056.exe

Filesize
468KB

MD5
95357adbabbb78bc714ba2a183273858

SHA1
27417b1bfc4fc3cca297da75e4704260cb05241b

SHA256
7f5969e5dd2b51f47e37f954538f5d1008ee8fa79db7e89971b5f2e4448d13f0

SHA512
3d080bee4741cddcecabc449dde2422ae0b40bbf1e870357d78dfe5e831dce5003d3add3dde0b9e83affd29165619ef3a0ad9b305ddea837990cb9d3706945f4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14099.exe

Filesize
468KB

MD5
e5a39ec7a7073e030c253139aa48ebbd

SHA1
8dfbdf86437c305f315128a8f5076742f664e3d3

SHA256
3d44bbc2ffb5968858a438644b57f9a810ff9d24453ba0e9b6396c9429dc024c

SHA512
a44b552a8fca333eda0e07a707e5dee67b0afb02821a8cf68043cf20eced3a55fa076be549ad8283932e8672b7b3b717d723265dd6d4615f8b5eba1d6737835c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe

Filesize
468KB

MD5
69cb6cc2f4237bcc053463178cb3974b

SHA1
67ada1b6ef926de70ca6c4f5f6036cb675abc2c5

SHA256
15c8b6546b3a4945288b7064bc186cf026518fcbca6357808c8213b36c468e19

SHA512
c4c1ff41f4c78de907166a651c7be7f72fbffc506cd5ea4c54bfe7e7326c6c430fa05ca2206b2f86434f6ea218d16df66d373b7d6bb2bd5082a6c909724b25bc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe

Filesize
468KB

MD5
f5336f50f388d6c7c21db0a184d3d8b7

SHA1
8ceaa3c27d8d487cb8e4bd9c09cc428b3ee5f8be

SHA256
5c53549beb2a6aaa83703be43b505233c8f49c344707587a3527ac24f7c20416

SHA512
2c7bedbabc2dc04c27b1b6289048c643a40072ab18807d82f017e9619c50569bcc3a208659f44d3c6ecb757bdd9dbccc2a747c57e6a637c22979b136b76265d1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34517.exe

Filesize
468KB

MD5
5a2b875f408f56543b30617df19272c6

SHA1
e7a685fd38bdfe25dfbed089fd883c2dd60b32d2

SHA256
f8c1f688fdd797c8fa54ac6191ab2986edaaf286bb84e11e9696ee759a003ca4

SHA512
9eb2175153765fd43228dcdf8926b9817a68d56809a2873888f975af81175e2fa18904a2d53843e60cca2929b6704c2f8953abc4d4f3f86ff3005af304d5747c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe

Filesize
468KB

MD5
14944580f5bf9e6f0405d263e4da153b

SHA1
50e8c86a6c499cbaf8fc86bd02f7cfc8387d5be3

SHA256
4afb7b6befbecab707bc34266636fc8c990b16570789866d05da7f52327f3de0

SHA512
61f4ba12fca994a6703ec6aab0b6ff967a680c5e7f34a0c4438321fc31fe15c921936c6b1bbb6d2507ec25f3028ae56a6f1a7245af17e30eef322067387e301c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe

Filesize
468KB

MD5
cc19c87f679cd4422be84850f5a5c1a6

SHA1
eb6d2628b5ab02e1edff9e399ce7201f606f0883

SHA256
3c8efbd1925e16c8a66034c421dd351b89981681307b748b9df7d6c425c89ee7

SHA512
69b6855236ae5a8a9e037834d05988f17de59ffb40556b43e352ef12b78c8bcd8c7a4c9774285c39183e414489b3d07bed9d26606c3749fd86c10b099fd3a5e9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40648.exe

Filesize
468KB

MD5
f7cc607416ed3148e954b36b86fe1416

SHA1
9bf93790e47ccb09669a10cba20c07595aa6cd80

SHA256
b07796489355a773c37b9694416f24c7217c6e427c1ab7bad9431d122fd88b2c

SHA512
a10c6950ef13fff13d4bf5d0d9b1e4867e73c7b4d22e9e305dbaf59c85b6b8eb7e1afe0b0e54ecd6470a1615c753639e678665384c0241c50c8c7eb3978ceaff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe

Filesize
468KB

MD5
2a1ad1b8d81945ed7ef30705e9c646ab

SHA1
8feaa1fc93fdf00b6fd77c491da32c5065f0a15a

SHA256
48f741475d5efaf061470ab878017d8f3bd455f926f078c3fe2a0aecb143e5a2

SHA512
6912c4b6cc5a033bc06d9b325e2d18316aa1937c5c5e074e4c16b54ed0b025b60e404bbaa6178305f648e4f3f5fb99bd74482e6072c49ee44ffcc0df0d0689c4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe

Filesize
468KB

MD5
a99e314104c1ae376580f789c3ec5dea

SHA1
5f55d44086b2d0fddc213fc203100b46a41a8650

SHA256
2ec98e298fe002a462415a81666756fb9f91ecbf850f6201419e38d6456ba087

SHA512
ab6fc83f79dc564a14a876964801684780ebac46639e4e0adf32e9e2788406b72402ac12f7c04c7cc8ef13113ecfcd05a4a426cadeec85683e67563058fe689c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57493.exe

Filesize
468KB

MD5
43e5fa90be8bcab5c53627ff1b839f31

SHA1
1da78bc003210ed7201f70a1d44aae48244193e5

SHA256
cd4080e8847fde1616e4093fbe7d322764b6119f8b88ccff1f94174a7bbd9551

SHA512
d8fc530d8f28e838d610b2e71c4e8bf95f1bb4039039740b82c1b7e57eab3e50b4471104cc9db9812635606cbc3dd10b354277b0f88e914f5111a774ff1bbd09

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe

Filesize
468KB

MD5
49ac142b505dbe588f0697d03b4060e4

SHA1
877065ab00415766061af4570fe74403544f6a4a

SHA256
c5de975c688e4351a6e30b4db7eb8be406042680bd42d25030918d39d4101870

SHA512
cc14e248798a1b2fa4651ce855089ebeb4213a158d1f243b95faf1beabb1558e537753593bccead332d21d7c58af05e112c5336bb2ff16f29ac81b583fbcba0d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60219.exe

Filesize
468KB

MD5
1eaa240284a126dde24ad72726a7114a

SHA1
d2fa4b18c2b6d7f9b4bd9792f40a0933959521b2

SHA256
81c3761bd7590ef296eb8903660ff1193bd2f6dbd64168ff6b93fc7d6be796a6

SHA512
f52a2080aee77a43598df24499ac7c399df347960e1dbd3bec7d17f99208fa56a56e69aa1f6265f3e36576802e95af5f720cd9a78082edf3142fc21f0a07a0fe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe

Filesize
468KB

MD5
0e937d5061e31ea3df804c7f47a4fd57

SHA1
dd0b280856eac0809408151395a7fa156a708a2f

SHA256
4e89715823abb2132c08a5d1548f46264d8e6a99c8a8e54aa2a178e18ead28e0

SHA512
b8b76d365f53f70d1f3e6511a0209f0b5017652c32105c273c5bd244b57c63a9061a30e3a827f258dccbc54c2ad6d08639f7d1faec5790ed98786c1f479f0b67

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe

Filesize
468KB

MD5
c50a3d8ba801e3aeff5168d672c9fb4f

SHA1
b815420dde46b566ec5a413bf171621ae7d15ef1

SHA256
870a4bbd3168d155a5024cb63950762e3951fc15e7a0951433cfdfc5568d0fa2

SHA512
d54c5414bfdd5398b9d220074511bc7691e7b92fc3b3fc22a2a31eb847267765d87e10c30f75a460763764520a10b6f80eaf992adc05ecc10cf2bad94b8e90e8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe

Filesize
468KB

MD5
fc0156a6f3e4d42c7fc13355d789b9c9

SHA1
80b8e117d11405652821d99a736640d0d8f6ff03

SHA256
e803ba34169ed360baa22abcfc1b038628af91932a8ad87048b2e0277376f437

SHA512
ca9ac3f59e01e7afd7e40a9df932c178f3b34e11cdda06a16236cc65faebe02d3ca762805e15366667665936049dd491e7e55e66608948235d595749dd9f5055

Download Submit