cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0d

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
Size

468KB
MD5

7bf59af40d6d9be5c14af7bfb08b4ed0
SHA1

c27ef8f9cfa4b10cf7929b0a34aeb9649c63ba7c
SHA256

cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0d
SHA512

93d7c2b6f79dad632930e4d2f11fc88f64256f96932672e70f127f1767c62de5a203c0c0e7483ed25546a08cb85be4ea9823a461155b7cde8aa0b4890aa89504
SSDEEP

3072:fguUogW+uIw5UrbYEHzcjrf8/EoOC3TpC6FH0pVCLwaRkrGmzFPeg:fgJoOgUrLH4jrfkN+AwaW6mzF

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2812	Unicorn-51522.exe
2704	Unicorn-63027.exe
2772	Unicorn-2129.exe
2676	Unicorn-46857.exe
2868	Unicorn-11562.exe
2616	Unicorn-13608.exe
2632	Unicorn-30499.exe
644	Unicorn-37402.exe
1868	Unicorn-42040.exe
2416	Unicorn-29426.exe
2068	Unicorn-13644.exe
1052	Unicorn-49846.exe
1668	Unicorn-4729.exe
1268	Unicorn-42373.exe
1248	Unicorn-36508.exe
1816	Unicorn-3790.exe
480	Unicorn-52097.exe
1644	Unicorn-34792.exe
2456	Unicorn-9218.exe
1672	Unicorn-1543.exe
2288	Unicorn-1221.exe
540	Unicorn-47215.exe
2424	Unicorn-58912.exe
1352	Unicorn-25285.exe
2236	Unicorn-14350.exe
1828	Unicorn-21698.exe
656	Unicorn-46852.exe
688	Unicorn-1735.exe
944	Unicorn-48890.exe
2480	Unicorn-59659.exe
2104	Unicorn-60640.exe
2936	Unicorn-33483.exe
1984	Unicorn-1408.exe
1020	Unicorn-9311.exe
3020	Unicorn-62840.exe
1536	Unicorn-9000.exe
2668	Unicorn-1579.exe
2796	Unicorn-21445.exe
2752	Unicorn-51740.exe
2872	Unicorn-59353.exe
2696	Unicorn-35211.exe
2980	Unicorn-55077.exe
2780	Unicorn-63629.exe
2604	Unicorn-43763.exe
2992	Unicorn-30765.exe
1864	Unicorn-24634.exe
308	Unicorn-43017.exe
2144	Unicorn-42752.exe
372	Unicorn-5684.exe
1740	Unicorn-24058.exe
2848	Unicorn-30743.exe
1804	Unicorn-50609.exe
2328	Unicorn-62284.exe
1744	Unicorn-18129.exe
1280	Unicorn-18129.exe
1820	Unicorn-9960.exe
1492	Unicorn-30935.exe
2300	Unicorn-8874.exe
1096	Unicorn-10920.exe
1640	Unicorn-38747.exe
2428	Unicorn-48554.exe
1292	Unicorn-58393.exe
1444	Unicorn-20890.exe
1300	Unicorn-55600.exe

Loads dropped DLL 64 IoCs

pid	Process
3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
2812	Unicorn-51522.exe
3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
2812	Unicorn-51522.exe
2772	Unicorn-2129.exe
2772	Unicorn-2129.exe
3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
2704	Unicorn-63027.exe
2704	Unicorn-63027.exe
2812	Unicorn-51522.exe
2812	Unicorn-51522.exe
2676	Unicorn-46857.exe
2676	Unicorn-46857.exe
2772	Unicorn-2129.exe
2772	Unicorn-2129.exe
2616	Unicorn-13608.exe
2616	Unicorn-13608.exe
2704	Unicorn-63027.exe
2704	Unicorn-63027.exe
2632	Unicorn-30499.exe
2632	Unicorn-30499.exe
2868	Unicorn-11562.exe
2868	Unicorn-11562.exe
3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
2812	Unicorn-51522.exe
3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
2812	Unicorn-51522.exe
1868	Unicorn-42040.exe
1868	Unicorn-42040.exe
2772	Unicorn-2129.exe
2772	Unicorn-2129.exe
1668	Unicorn-4729.exe
1668	Unicorn-4729.exe
1052	Unicorn-49846.exe
1052	Unicorn-49846.exe
1268	Unicorn-42373.exe
2632	Unicorn-30499.exe
1268	Unicorn-42373.exe
2868	Unicorn-11562.exe
2632	Unicorn-30499.exe
2868	Unicorn-11562.exe
1248	Unicorn-36508.exe
1248	Unicorn-36508.exe
3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
2616	Unicorn-13608.exe
3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
2616	Unicorn-13608.exe
2812	Unicorn-51522.exe
2812	Unicorn-51522.exe
2068	Unicorn-13644.exe
2068	Unicorn-13644.exe
644	Unicorn-37402.exe
644	Unicorn-37402.exe
2704	Unicorn-63027.exe
2704	Unicorn-63027.exe
2676	Unicorn-46857.exe
2676	Unicorn-46857.exe
1816	Unicorn-3790.exe
1816	Unicorn-3790.exe
1868	Unicorn-42040.exe
1868	Unicorn-42040.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2248	2416	WerFault.exe	39
1072	3020	WerFault.exe	64
4296	1620	WerFault.exe	100
6636	832	WerFault.exe	178

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8809.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
2812	Unicorn-51522.exe
2772	Unicorn-2129.exe
2704	Unicorn-63027.exe
2676	Unicorn-46857.exe
2616	Unicorn-13608.exe
2868	Unicorn-11562.exe
2632	Unicorn-30499.exe
1868	Unicorn-42040.exe
644	Unicorn-37402.exe
1052	Unicorn-49846.exe
2416	Unicorn-29426.exe
1668	Unicorn-4729.exe
1268	Unicorn-42373.exe
1248	Unicorn-36508.exe
2068	Unicorn-13644.exe
1816	Unicorn-3790.exe
480	Unicorn-52097.exe
1644	Unicorn-34792.exe
2456	Unicorn-9218.exe
1672	Unicorn-1543.exe
2288	Unicorn-1221.exe
2424	Unicorn-58912.exe
540	Unicorn-47215.exe
1352	Unicorn-25285.exe
2236	Unicorn-14350.exe
1828	Unicorn-21698.exe
656	Unicorn-46852.exe
688	Unicorn-1735.exe
944	Unicorn-48890.exe
2480	Unicorn-59659.exe
2104	Unicorn-60640.exe
2936	Unicorn-33483.exe
1984	Unicorn-1408.exe
1020	Unicorn-9311.exe
3020	Unicorn-62840.exe
1536	Unicorn-9000.exe
2796	Unicorn-21445.exe
2668	Unicorn-1579.exe
2752	Unicorn-51740.exe
2872	Unicorn-59353.exe
2696	Unicorn-35211.exe
2980	Unicorn-55077.exe
2780	Unicorn-63629.exe
2604	Unicorn-43763.exe
2992	Unicorn-30765.exe
1864	Unicorn-24634.exe
308	Unicorn-43017.exe
372	Unicorn-5684.exe
2144	Unicorn-42752.exe
1740	Unicorn-24058.exe
1804	Unicorn-50609.exe
2848	Unicorn-30743.exe
1744	Unicorn-18129.exe
2328	Unicorn-62284.exe
1280	Unicorn-18129.exe
1820	Unicorn-9960.exe
1492	Unicorn-30935.exe
2300	Unicorn-8874.exe
1096	Unicorn-10920.exe
1640	Unicorn-38747.exe
2428	Unicorn-48554.exe
1292	Unicorn-58393.exe
1444	Unicorn-20890.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2812	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	30
PID 3028 wrote to memory of 2812	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	30
PID 3028 wrote to memory of 2812	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	30
PID 3028 wrote to memory of 2812	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	30
PID 3028 wrote to memory of 2772	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	32
PID 3028 wrote to memory of 2772	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	32
PID 3028 wrote to memory of 2772	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	32
PID 3028 wrote to memory of 2772	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	32
PID 2812 wrote to memory of 2704	2812	Unicorn-51522.exe	31
PID 2812 wrote to memory of 2704	2812	Unicorn-51522.exe	31
PID 2812 wrote to memory of 2704	2812	Unicorn-51522.exe	31
PID 2812 wrote to memory of 2704	2812	Unicorn-51522.exe	31
PID 2772 wrote to memory of 2676	2772	Unicorn-2129.exe	33
PID 2772 wrote to memory of 2676	2772	Unicorn-2129.exe	33
PID 2772 wrote to memory of 2676	2772	Unicorn-2129.exe	33
PID 2772 wrote to memory of 2676	2772	Unicorn-2129.exe	33
PID 3028 wrote to memory of 2868	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	34
PID 3028 wrote to memory of 2868	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	34
PID 3028 wrote to memory of 2868	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	34
PID 3028 wrote to memory of 2868	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	34
PID 2704 wrote to memory of 2616	2704	Unicorn-63027.exe	35
PID 2704 wrote to memory of 2616	2704	Unicorn-63027.exe	35
PID 2704 wrote to memory of 2616	2704	Unicorn-63027.exe	35
PID 2704 wrote to memory of 2616	2704	Unicorn-63027.exe	35
PID 2812 wrote to memory of 2632	2812	Unicorn-51522.exe	36
PID 2812 wrote to memory of 2632	2812	Unicorn-51522.exe	36
PID 2812 wrote to memory of 2632	2812	Unicorn-51522.exe	36
PID 2812 wrote to memory of 2632	2812	Unicorn-51522.exe	36
PID 2676 wrote to memory of 644	2676	Unicorn-46857.exe	37
PID 2676 wrote to memory of 644	2676	Unicorn-46857.exe	37
PID 2676 wrote to memory of 644	2676	Unicorn-46857.exe	37
PID 2676 wrote to memory of 644	2676	Unicorn-46857.exe	37
PID 2772 wrote to memory of 1868	2772	Unicorn-2129.exe	38
PID 2772 wrote to memory of 1868	2772	Unicorn-2129.exe	38
PID 2772 wrote to memory of 1868	2772	Unicorn-2129.exe	38
PID 2772 wrote to memory of 1868	2772	Unicorn-2129.exe	38
PID 2616 wrote to memory of 2416	2616	Unicorn-13608.exe	39
PID 2616 wrote to memory of 2416	2616	Unicorn-13608.exe	39
PID 2616 wrote to memory of 2416	2616	Unicorn-13608.exe	39
PID 2616 wrote to memory of 2416	2616	Unicorn-13608.exe	39
PID 2704 wrote to memory of 2068	2704	Unicorn-63027.exe	40
PID 2704 wrote to memory of 2068	2704	Unicorn-63027.exe	40
PID 2704 wrote to memory of 2068	2704	Unicorn-63027.exe	40
PID 2704 wrote to memory of 2068	2704	Unicorn-63027.exe	40
PID 2632 wrote to memory of 1052	2632	Unicorn-30499.exe	41
PID 2632 wrote to memory of 1052	2632	Unicorn-30499.exe	41
PID 2632 wrote to memory of 1052	2632	Unicorn-30499.exe	41
PID 2632 wrote to memory of 1052	2632	Unicorn-30499.exe	41
PID 2868 wrote to memory of 1668	2868	Unicorn-11562.exe	42
PID 2868 wrote to memory of 1668	2868	Unicorn-11562.exe	42
PID 2868 wrote to memory of 1668	2868	Unicorn-11562.exe	42
PID 2868 wrote to memory of 1668	2868	Unicorn-11562.exe	42
PID 3028 wrote to memory of 1268	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	43
PID 3028 wrote to memory of 1268	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	43
PID 3028 wrote to memory of 1268	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	43
PID 3028 wrote to memory of 1268	3028	cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe	43
PID 2812 wrote to memory of 1248	2812	Unicorn-51522.exe	44
PID 2812 wrote to memory of 1248	2812	Unicorn-51522.exe	44
PID 2812 wrote to memory of 1248	2812	Unicorn-51522.exe	44
PID 2812 wrote to memory of 1248	2812	Unicorn-51522.exe	44
PID 1868 wrote to memory of 1816	1868	Unicorn-42040.exe	45
PID 1868 wrote to memory of 1816	1868	Unicorn-42040.exe	45
PID 1868 wrote to memory of 1816	1868	Unicorn-42040.exe	45
PID 1868 wrote to memory of 1816	1868	Unicorn-42040.exe	45

C:\Users\Admin\AppData\Local\Temp\cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe
"C:\Users\Admin\AppData\Local\Temp\cced03ce24814c16bbfda930a22b0067f934de4997154482fed380bf00df6f0dN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63027.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57262.exe
        7⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        8⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 236
        8⤵
        Program crash
        
        PID:4296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 236
        7⤵
        Program crash
        
        PID:1072
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 236
        6⤵
        Program crash
        
        PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14350.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64396.exe
        7⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        7⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        6⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54310.exe
        7⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        6⤵
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21401.exe
        6⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24058.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        6⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
        7⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        6⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        6⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
        5⤵
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34932.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12330.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42820.exe
        7⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24728.exe
        8⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        8⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19318.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56961.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7145.exe
        7⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22207.exe
        6⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41640.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54924.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
        7⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12424.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27235.exe
        6⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30935.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50412.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35659.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        6⤵
        
        PID:236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53946.exe
        6⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        7⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        8⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        8⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59008.exe
        8⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64873.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25344.exe
        7⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27173.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13712.exe
        6⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        6⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        5⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14983.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42752.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        5⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35659.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        6⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33313.exe
      4⤵
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        5⤵
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45034.exe
      4⤵
      PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11042.exe
      4⤵
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11710.exe
      4⤵
      PID:7312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49846.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
        7⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        8⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        8⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17578.exe
        7⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        7⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        6⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exe
        7⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        6⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51053.exe
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21658.exe
        6⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        7⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-576.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
        7⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        6⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48424.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        5⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        7⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        7⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59008.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        7⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35253.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29364.exe
        5⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52091.exe
        6⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30044.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1556.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        6⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15238.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        5⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14470.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
      4⤵
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6686.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57123.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40019.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
      4⤵
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31837.exe
      4⤵
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36508.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        7⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3228.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        6⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        5⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        6⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59008.exe
        7⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
        5⤵
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        6⤵
        
        PID:6296
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 216
        6⤵
        Program crash
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51053.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55067.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64510.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        5⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63863.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        6⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48989.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exe
      4⤵
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54310.exe
        5⤵
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
      4⤵
      PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
      4⤵
      PID:6368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21698.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10920.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe
      4⤵
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46563.exe
        5⤵
        
        PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
      4⤵
      PID:7032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14418.exe
      4⤵
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        5⤵
        
        PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
      4⤵
      PID:6444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40950.exe
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
    3⤵
    PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
    3⤵
    PID:6720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2129.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2129.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46857.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37402.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        8⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7130.exe
        8⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        8⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
        8⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
        7⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        6⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        7⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19318.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exe
        6⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30743.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38160.exe
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24728.exe
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        7⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
        7⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        6⤵
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
        6⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        6⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exe
        5⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19318.exe
        6⤵
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        5⤵
        
        PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        6⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        7⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15697.exe
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        5⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33675.exe
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
        6⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
        5⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        5⤵
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
      4⤵
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53892.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61503.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1361.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63604.exe
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
      4⤵
      PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42040.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3790.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        7⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        7⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        6⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        6⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58393.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        6⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18838.exe
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63092.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11735.exe
        5⤵
        
        PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29227.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33483.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45620.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        6⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        5⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
        5⤵
        
        PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
      4⤵
      Executes dropped EXE
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5150.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
      4⤵
      PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
      4⤵
      PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
      4⤵
      PID:7024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52097.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21082.exe
        5⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        6⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26143.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        7⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16642.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42056.exe
      4⤵
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17783.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        5⤵
        
        PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27049.exe
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
      4⤵
      PID:6932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9311.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
      4⤵
      PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        5⤵
        
        PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
      4⤵
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
      4⤵
      PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
    3⤵
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
      4⤵
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
      4⤵
      PID:6568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45034.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
    3⤵
    PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
    3⤵
    PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37718.exe
    3⤵
    PID:6820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4729.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        6⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        7⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13854.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50635.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
        7⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48424.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        5⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        6⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12143.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        5⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        5⤵
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
      4⤵
      PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3400.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        5⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43753.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
      4⤵
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3767.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
      4⤵
      PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8874.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
      4⤵
      PID:820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
      4⤵
      PID:6344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
    3⤵
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
      4⤵
      PID:7928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
    3⤵
    PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52402.exe
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23873.exe
    3⤵
    PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
    3⤵
    PID:6756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42373.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42373.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21445.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21658.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        6⤵
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
      4⤵
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56598.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21867.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
        5⤵
        
        PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32081.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
      4⤵
      PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21401.exe
      4⤵
      PID:8096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
      4⤵
      PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
      4⤵
      PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
      4⤵
      PID:7120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
    3⤵
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
    3⤵
    PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
    3⤵
    PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
    3⤵
    PID:6772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25285.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25285.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exe
      4⤵
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
      4⤵
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
      4⤵
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe
    3⤵
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
    3⤵
    PID:4148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
    3⤵
    PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22130.exe
    3⤵
    PID:7076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
    3⤵
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
      4⤵
      PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
    3⤵
    PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
    3⤵
    PID:4456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23343.exe
    3⤵
    PID:6104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
    3⤵
    PID:6880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33844.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33844.exe
  2⤵
  PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
    3⤵
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
    3⤵
    PID:5940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55770.exe
    3⤵
    PID:6572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
  2⤵
  PID:3388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
  2⤵
  PID:920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5898.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5898.exe
  2⤵
  PID:6780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe

Filesize
468KB

MD5
e8b98d4527e70b246c06cb0cbad8bf5d

SHA1
145d42fd44780e8e1a84d2173335c3175f4fc8bd

SHA256
b2a38bae3b84cfce4fd6ddbc2aaaad18dcd71f66256f56dc324ad41487fe105b

SHA512
b69cd720dadbe0ecae4d8bce9f27d03ee0e3eee8f1c7b9f8da77bb48df840bb9fecb8afbba307ca72d3c55074b73ff58f1c0bf6ccfe7bb7a31f29ef5faeb8a58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe

Filesize
468KB

MD5
b689c7292c34c221fc7f13cd49758868

SHA1
8bbe9d87c38d534f4ae6a3d83fcb4f03f98a5b4f

SHA256
a8b44115ff1f384bd6cdb32492864b3d7f1effe8522c54d499b3765285795969

SHA512
a9a432f711b2daa0881e3421539c6b766b135098794196f1d4303ace688db371ededca5845d1db1d08e922af1d5faf65641014012c9490661dafcd865807a89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe

Filesize
468KB

MD5
cea6fe60711ac82732e069ddd30dfede

SHA1
2481fa20323b4e81e90fae6000b8ac285be6ec88

SHA256
02250708fb0d9843e7e0b28996a092274555a9274ab5eb917e73e6f885b24349

SHA512
bc7f61bc3397102a6786244dc5268f01e2cf786052ec5c206eab0f75faf2e2e761178b8f629dabc1871cfe064e0211ebfe2cf500d399311595a251b90e032ad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe

Filesize
468KB

MD5
70568f66fb3ead4fd858bb7b42a44be1

SHA1
edb4d808112bd4f6da31cc9b9c280f3863cc0cb7

SHA256
467d12727cc6e891ecbc8fb2cc182218b19d28958b90e0a0cf097740a65e0013

SHA512
0bb0d8cd50db0d04de9ee1889827e4fd393be783cf06a54bedee858a1ce1e4dea4931f35bdf7a9a3e219eec46f6cfd7e50010cfcd626203c29a744643837f9d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42040.exe

Filesize
468KB

MD5
953cd5c7bccdd380798f9078a4157a64

SHA1
21dbd8c14180e08d6375b5e99ed2e2faf20e75e6

SHA256
76b70ac2ffec416be258f546dd7e1011891c3ee4eff6980069dc9668e5def74f

SHA512
50316301b3cbd2bfadf669180ea48640a44cb0687f23cbb81a4eaeab1417e757045c9bc6684d7571f34c1bdc21bc444363223ed75439c2ba356c0cb83e154e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe

Filesize
468KB

MD5
f80acd2852dd192b8667e4dc309d305b

SHA1
cdb03ceb79b24d5b619000c1508ba077eb6b9311

SHA256
4962eabd7d9fc5403ebea89024cf631478d13dec0de456d7d824e7180b49ac77

SHA512
6c84ca6c2b5aca6c5df58f1a64fa148dc355d8f6ad4ade18f89ddbae770d975f8244e6313a0fe69e5189da83a0081c3aaebe2efb61d2520bc2e34484c2fa69de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe

Filesize
468KB

MD5
9bd6d82974a75a76dce8a6156fbe9622

SHA1
78b658252ff7e0203d724a8f6f6c479c68558193

SHA256
462bcaacbf763e6e5c4ddc3d5490b7df1634caf8e80799b71f21b2cfb3abbac7

SHA512
aa72feaee63c7cbbb401910327d0736efa90d21dc179b7b3e0fc2bcdc5b08d3dab156fe89ee3e41012e9aea17779a77c220f2ffff5b62bd002efa65203034fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe

Filesize
468KB

MD5
882cc9756cf4fe1b455c87c052a0c6ed

SHA1
1a58be94ff7989bc2edd27a9ce9fe6542c1df530

SHA256
c89e89b39c6c1ba8d7011d78218e67213612aa8c7dc6f7a0639291617ff24a28

SHA512
ed69ae04bfd078fbd21997cc5a69f053d75fb80fc59aa63e4db49e280dd8e397dd7eb705af32d4bdae292744aad889e6505b623a5a91c1a2e92b0dcf61628d9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe

Filesize
468KB

MD5
09b15b8dce26b821c4ee6e8d978efb38

SHA1
67c9e623265e82882e7c491869f387a28c45d355

SHA256
d6cffe589e0885dec84c8781686361d1500aa6b4c4ba07638490310eb22df7c1

SHA512
313d6884814183e54cd7678b1226c69e339ebce811326346f7ada3b150f4e77fb55ad190c5e9f4712b4f15a8449ce065a6168691d8092ee684577484bd0495b9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe

Filesize
468KB

MD5
218634591b4afef8492e6e065e6bcabf

SHA1
4649874db60ee9d876863da7ff3d77d430d00de0

SHA256
20f26005c3ae514419ccbe04cda5d1dcb72cf22470790d1e1ebaf93cc28dbaa7

SHA512
0f6874f3016b403be970eebd0a79607f4033f12e9d102d212ec74dc82df44ce412c0b49eb0cfedbc33360a6b27dac92aa5b78d75de347c0da1ee07d73a38d9bf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe

Filesize
468KB

MD5
ed25de7af8d11687a6a4ae330adc4109

SHA1
34517a4cad4e7edf290d5f54b2c5af87a2dd7769

SHA256
8a53c307a41f1d3467b2e24fb92bf97b8a6c64c36b60d3fced75c8e8bd5283a1

SHA512
b0a05fd850fa1607f0a15ecffedff4be173a48f50541924b02b16b6c1c7369e081f45dc48d0f5de0964bbb34fcc398bbcf14e95dcb916686dbc1e07d826796dd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2129.exe

Filesize
468KB

MD5
d0144c00f68d9c37287a8b64caaafabc

SHA1
0792e0ebbb3780db0e11e21d636547923699b01c

SHA256
35ab4edcf16b73fb86d885d3d18e859c22ad6c83ba43a28643ad40b624287c97

SHA512
35c24c110d948ae3cbf5fa6a4dc902f1facc62895b914bc56a89c4c3d7616b41fd1df5ccc992b50fcd90688b6ba97f574d499864e9774f7a3a2a7b897cdcf69d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe

Filesize
468KB

MD5
2ea7bec795d705844bfbd3bc33005e91

SHA1
082d7ecc2b64b608b7dfed5c5e1a116ece42af60

SHA256
d43ad07b7590565a93df56648ef1db142cc651a3c14a1fdc33682d258b9d271a

SHA512
1cbec7ec67ac4acddb6e05f0b4b42dc6b34d7db493f187c4b1a7c1870e41d5df0720fd2a43d859f75dab0fa11308b05dd4ad5e190792382d04ff90f99cafc0ff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe

Filesize
468KB

MD5
852283767d9dc642e369057bab28edf8

SHA1
f8859415d106265bdb4d6b3ad45c1b945f35a5eb

SHA256
d04647bca0d9e5b33db1386b9a8f4497f5176d4b71945815ccf1a48a7a3ffe04

SHA512
d6953b0084e63bfba28753a82dc7b5a8dcb48f971de15a5ad5005c86b00ce1aa46eb20c1ff1aa644f86e39ae026e4a4c41527fefecba24d4fa84747a8af1e5e0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe

Filesize
468KB

MD5
2ee15daaf3a2ac32fbffba17719d8452

SHA1
e9b3bf8b64266ec8f04af3f93f0f8dfbddbd9443

SHA256
73f95c2bd550e4f503c4efd735c1b7ee3703b0c8c2ffbdb74bda9808634c7bca

SHA512
d742dce82add3312becf1c0e384599e95ddf2c8fba5e4b2ec4cb7ab6162018c96f7a737d700f6a4cc01d328391076a246282808491408a702d735073b19cf5d4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36508.exe

Filesize
468KB

MD5
53432276c440e3a3035faaf2010c8201

SHA1
848b56450fa8197db362b49b4f62628538e41537

SHA256
a0ffe4f2c8d7d9d55449b1c3bfcbe9b24ad2632efdd280521cff04db3db5aa39

SHA512
f01651d803e423967c6e2bc6ac85686072b0067acee42eeaf25a9f5dd9a19363d662f86916e1f9b3194378f4bafd3cc10751d0e318e63a9ad54b268360e0a3f1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37402.exe

Filesize
468KB

MD5
ea49dff0f6e1f23478fe372aabbfb22a

SHA1
8c1f62cb653269b576a428139135d7d7b07b5bfd

SHA256
3affe1f6efe5d5e35e82de51e73d9e0357e536c6a11ad411ae35ddbb2bf9a6bd

SHA512
3830f08bf40b25448a4264ea9d4a24b7150defe3ff9dd1843023a12e12249071c2d3c5d8ea6251fb30115f14cd145cfd4a8da9ed2e01b9cf53953a6e2003a9f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3790.exe

Filesize
468KB

MD5
abd1cbfea45649c787f039eb8feb9e63

SHA1
9f742ff8f984364965dee370477fec1cc85609f4

SHA256
6cbb7a99094b5a8d1ad0eb36a662910715c000f4dba4616d423ae8e528f7a330

SHA512
dfdf444f6435c2343b5f117e4e941c2f01f86b4eff00c05022e8729c3b587fdead21783ee9625d08d84e271e590d4f4342f94edb5e1accf4ee9b9eff15c13f84

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42373.exe

Filesize
468KB

MD5
d92b9412873bd1481b805e0a0771db1c

SHA1
7a4addcc6e1fee2b651c7aa4c3214050d142710d

SHA256
625747dd90e01232ed15f5714878b4445d20047486ed31f2eec4bde1d92fe8e6

SHA512
fc7b0aa0ab46bc014609725edbd361e74f2d724ea814f34a27c54cb15765e5d153fba694b41fc0468f380080536fa973b8898735e1c5e7f24e4f8278c2ab9f86

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46857.exe

Filesize
468KB

MD5
6b14ff6d848474ae55b9c8639c685588

SHA1
1ad1d98683f896a05b338f24f93bf28404aa2b28

SHA256
405d12b143d05a11b06c79d8a65ca9e1cce4cfe1806ddbe129a6c25f84cbfe45

SHA512
7a75ef8251714dc590b0f0802f6a7804bfc5ba5969ca5b38a098bca00bbdb6d4f3e007c5d9534457b158579e24bc9fc11a5e120344b822697d982f75c4b41ffd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4729.exe

Filesize
468KB

MD5
bd4bc316034dec2906755c89e7d59d4f

SHA1
5669ca8aec707c08935c12bb59cb03599d473c8a

SHA256
3822d29f0eb124809fe1a3aae198b6c3f19a469b2b179b5953f3dc631e894c98

SHA512
5d81c796623f26f6bf2e6e4f87a90265743b82cd11fe4cf41d33b85166b71933c7152b8cab19e94583947bf5d61c1293a170697e629450169a6de25992644a0c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49846.exe

Filesize
468KB

MD5
c04c2f89a0275efe5c55a6f14d7b085c

SHA1
0b0a43a4a81b38fb09c76193a61c39bd8e0027fd

SHA256
970dbcbd1bc4da7e68918ecad435ff6a301dfea456772a08420481164be128ca

SHA512
49839b7e8be81c443b961e771fb644631162ec55cd66f85ed3b0fd47cbb6dd7ba0a552518713f38bdba726fed49a3a52c6a6c88e45b6ef73f2af24965e2caaf6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51522.exe

Filesize
468KB

MD5
49df92801392fdade0f05737cf8cc488

SHA1
d70f866a826accf298cb6da177c71f6093f87b54

SHA256
66c4afba28f72378ef559402e95b74cb813ec1ce741510253c82dcff574021eb

SHA512
95f73be71604670995c9ee52ac20969c1317eee56fc19d78d8edd46773d724d7e673c1d7a5260af307b569f51ac45f660a53ebfedf74b833ffad39a48cf5c881

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52097.exe

Filesize
468KB

MD5
4b102852d7dd291c9834c9277fc8807b

SHA1
4b177b731e25d68d8c94d27a858f0d95581e8f1b

SHA256
d1ffc7b99a00fc0190b990538e51e028566c0542821320aceec7662d243b5014

SHA512
6b1313927fe96e02a82baef201d266527afd445d300bcbfa61e4eeb0244ce46d92d4781f9cec7c1fd9ab24e11b4da0c4a3190c0de8a789e7eb366b9237e79702

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63027.exe

Filesize
468KB

MD5
5d4228c51d869af7410d848a1416adc2

SHA1
ad81bd0ace94aa539740d0ef5e26b57dd98dd974

SHA256
69faf9ce21e0c1113d686566adf5e65a5c9c2fe583561678f2d714edb18aad82

SHA512
923a34ed2211d7f7a98ace55f71ba8b06fe4629b7760694593d251e352a2ef4e69828f3880d70f2282e78db48062199a41d02fe252928aef6c74a692bdcc3ca4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe

Filesize
468KB

MD5
f4b5fa970af09bdfeb300657fab9dd7e

SHA1
41022eb796fdc0dc4b66405f0b93655d7d6cb728

SHA256
40d3055d8b3c9dac228250909f066f02717ffec42bd1bf8457b9c5272a6c1949

SHA512
d06ac9e039ef79cf63bb02caaf6e327c11db771dbebc92eb74940c4754f451a3b23d8d39080dbfc7c11faa4152d0114fa9bc9b184c903ea2bd71e984bb0fa6e7

Download Submit