154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
Size

468KB
MD5

627508fa572875689886526fde382f30
SHA1

708bdf9694352f6600cbf3a7d3715fb4a30282f7
SHA256

154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73
SHA512

17d73db8dce875a368019494c9dc6093da226eb733cc4ec09b3fb7cd73642a7c52d0289ecdea5a88583d97dff0fbf2543d47d24cba702dfc70c3e648b1ac37c1
SSDEEP

3072:9tAdorldI03YtbY2PzcIffT/ECpZtumMnsHxdVVBmhPaMg/7tSl4:9tqoQOYtBP4IffrhzLmhiF/7t

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1704	Unicorn-3197.exe
2420	Unicorn-27509.exe
2400	Unicorn-59627.exe
2748	Unicorn-37920.exe
2764	Unicorn-41027.exe
2868	Unicorn-23207.exe
2912	Unicorn-42916.exe
2864	Unicorn-5605.exe
2680	Unicorn-48676.exe
2624	Unicorn-5605.exe
1944	Unicorn-46181.exe
1552	Unicorn-26580.exe
1808	Unicorn-53675.exe
1640	Unicorn-31208.exe
1884	Unicorn-58698.exe
1548	Unicorn-13986.exe
1436	Unicorn-34142.exe
2116	Unicorn-26239.exe
2288	Unicorn-26239.exe
2456	Unicorn-51682.exe
2488	Unicorn-51682.exe
2312	Unicorn-6010.exe
688	Unicorn-48889.exe
448	Unicorn-55019.exe
2696	Unicorn-37920.exe
1180	Unicorn-48880.exe
1260	Unicorn-4702.exe
1612	Unicorn-8039.exe
1688	Unicorn-5024.exe
1452	Unicorn-4759.exe
1576	Unicorn-35734.exe
1848	Unicorn-26405.exe
1308	Unicorn-43487.exe
776	Unicorn-33888.exe
1424	Unicorn-5414.exe
2148	Unicorn-38465.exe
1516	Unicorn-30297.exe
2576	Unicorn-59440.exe
2384	Unicorn-3554.exe
1652	Unicorn-62969.exe
2920	Unicorn-1516.exe
2012	Unicorn-50909.exe
2180	Unicorn-18791.exe
2852	Unicorn-38657.exe
2760	Unicorn-13695.exe
2724	Unicorn-59632.exe
2776	Unicorn-55953.exe
2684	Unicorn-49823.exe
2656	Unicorn-55953.exe
3020	Unicorn-48340.exe
1980	Unicorn-42739.exe
108	Unicorn-49394.exe
2692	Unicorn-20614.exe
1428	Unicorn-748.exe
1016	Unicorn-2231.exe
316	Unicorn-58522.exe
2096	Unicorn-12643.exe
1940	Unicorn-25658.exe
344	Unicorn-34764.exe
2480	Unicorn-29934.exe
572	Unicorn-13332.exe
1744	Unicorn-769.exe
1996	Unicorn-17852.exe
1456	Unicorn-37718.exe

Loads dropped DLL 64 IoCs

pid	Process
1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
1704	Unicorn-3197.exe
1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
1704	Unicorn-3197.exe
2420	Unicorn-27509.exe
2420	Unicorn-27509.exe
1704	Unicorn-3197.exe
1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
1704	Unicorn-3197.exe
2400	Unicorn-59627.exe
2400	Unicorn-59627.exe
2748	Unicorn-37920.exe
2764	Unicorn-41027.exe
2748	Unicorn-37920.exe
1704	Unicorn-3197.exe
1704	Unicorn-3197.exe
2764	Unicorn-41027.exe
1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
2420	Unicorn-27509.exe
2420	Unicorn-27509.exe
1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
2912	Unicorn-42916.exe
2912	Unicorn-42916.exe
2400	Unicorn-59627.exe
2400	Unicorn-59627.exe
2868	Unicorn-23207.exe
2868	Unicorn-23207.exe
2680	Unicorn-48676.exe
2680	Unicorn-48676.exe
1704	Unicorn-3197.exe
1704	Unicorn-3197.exe
2864	Unicorn-5605.exe
2864	Unicorn-5605.exe
2624	Unicorn-5605.exe
2624	Unicorn-5605.exe
2748	Unicorn-37920.exe
2764	Unicorn-41027.exe
1552	Unicorn-26580.exe
1552	Unicorn-26580.exe
2748	Unicorn-37920.exe
2764	Unicorn-41027.exe
2420	Unicorn-27509.exe
2420	Unicorn-27509.exe
1944	Unicorn-46181.exe
1944	Unicorn-46181.exe
1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
1808	Unicorn-53675.exe
1808	Unicorn-53675.exe
2912	Unicorn-42916.exe
2912	Unicorn-42916.exe
1640	Unicorn-31208.exe
1640	Unicorn-31208.exe
2400	Unicorn-59627.exe
1884	Unicorn-58698.exe
2400	Unicorn-59627.exe
1884	Unicorn-58698.exe
2868	Unicorn-23207.exe
2868	Unicorn-23207.exe
1548	Unicorn-13986.exe
1548	Unicorn-13986.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5444	2816	WerFault.exe	132

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43023.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
1704	Unicorn-3197.exe
2400	Unicorn-59627.exe
2420	Unicorn-27509.exe
2748	Unicorn-37920.exe
2764	Unicorn-41027.exe
2868	Unicorn-23207.exe
2912	Unicorn-42916.exe
2680	Unicorn-48676.exe
2864	Unicorn-5605.exe
1944	Unicorn-46181.exe
2624	Unicorn-5605.exe
1552	Unicorn-26580.exe
1808	Unicorn-53675.exe
1640	Unicorn-31208.exe
1884	Unicorn-58698.exe
1548	Unicorn-13986.exe
1436	Unicorn-34142.exe
2288	Unicorn-26239.exe
2116	Unicorn-26239.exe
2488	Unicorn-51682.exe
2312	Unicorn-6010.exe
2456	Unicorn-51682.exe
448	Unicorn-55019.exe
688	Unicorn-48889.exe
2696	Unicorn-37920.exe
1180	Unicorn-48880.exe
1260	Unicorn-4702.exe
1612	Unicorn-8039.exe
1452	Unicorn-4759.exe
1688	Unicorn-5024.exe
1576	Unicorn-35734.exe
1848	Unicorn-26405.exe
1308	Unicorn-43487.exe
776	Unicorn-33888.exe
1424	Unicorn-5414.exe
2148	Unicorn-38465.exe
1516	Unicorn-30297.exe
2576	Unicorn-59440.exe
2384	Unicorn-3554.exe
1652	Unicorn-62969.exe
2920	Unicorn-1516.exe
2012	Unicorn-50909.exe
2180	Unicorn-18791.exe
2852	Unicorn-38657.exe
2760	Unicorn-13695.exe
2724	Unicorn-59632.exe
2656	Unicorn-55953.exe
2776	Unicorn-55953.exe
2684	Unicorn-49823.exe
3020	Unicorn-48340.exe
1980	Unicorn-42739.exe
108	Unicorn-49394.exe
1428	Unicorn-748.exe
2692	Unicorn-20614.exe
1016	Unicorn-2231.exe
316	Unicorn-58522.exe
2096	Unicorn-12643.exe
1940	Unicorn-25658.exe
344	Unicorn-34764.exe
2480	Unicorn-29934.exe
572	Unicorn-13332.exe
1996	Unicorn-17852.exe
1744	Unicorn-769.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1704	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	30
PID 1856 wrote to memory of 1704	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	30
PID 1856 wrote to memory of 1704	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	30
PID 1856 wrote to memory of 1704	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	30
PID 1856 wrote to memory of 2420	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	33
PID 1856 wrote to memory of 2420	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	33
PID 1856 wrote to memory of 2420	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	33
PID 1856 wrote to memory of 2420	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	33
PID 1704 wrote to memory of 2400	1704	Unicorn-3197.exe	32
PID 1704 wrote to memory of 2400	1704	Unicorn-3197.exe	32
PID 1704 wrote to memory of 2400	1704	Unicorn-3197.exe	32
PID 1704 wrote to memory of 2400	1704	Unicorn-3197.exe	32
PID 2420 wrote to memory of 2748	2420	Unicorn-27509.exe	34
PID 2420 wrote to memory of 2748	2420	Unicorn-27509.exe	34
PID 2420 wrote to memory of 2748	2420	Unicorn-27509.exe	34
PID 2420 wrote to memory of 2748	2420	Unicorn-27509.exe	34
PID 1856 wrote to memory of 2764	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	36
PID 1856 wrote to memory of 2764	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	36
PID 1856 wrote to memory of 2764	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	36
PID 1856 wrote to memory of 2764	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	36
PID 1704 wrote to memory of 2868	1704	Unicorn-3197.exe	35
PID 1704 wrote to memory of 2868	1704	Unicorn-3197.exe	35
PID 1704 wrote to memory of 2868	1704	Unicorn-3197.exe	35
PID 1704 wrote to memory of 2868	1704	Unicorn-3197.exe	35
PID 2400 wrote to memory of 2912	2400	Unicorn-59627.exe	37
PID 2400 wrote to memory of 2912	2400	Unicorn-59627.exe	37
PID 2400 wrote to memory of 2912	2400	Unicorn-59627.exe	37
PID 2400 wrote to memory of 2912	2400	Unicorn-59627.exe	37
PID 2748 wrote to memory of 2864	2748	Unicorn-37920.exe	38
PID 2748 wrote to memory of 2864	2748	Unicorn-37920.exe	38
PID 2748 wrote to memory of 2864	2748	Unicorn-37920.exe	38
PID 2748 wrote to memory of 2864	2748	Unicorn-37920.exe	38
PID 1704 wrote to memory of 2680	1704	Unicorn-3197.exe	40
PID 1704 wrote to memory of 2680	1704	Unicorn-3197.exe	40
PID 1704 wrote to memory of 2680	1704	Unicorn-3197.exe	40
PID 1704 wrote to memory of 2680	1704	Unicorn-3197.exe	40
PID 2764 wrote to memory of 2624	2764	Unicorn-41027.exe	39
PID 2764 wrote to memory of 2624	2764	Unicorn-41027.exe	39
PID 2764 wrote to memory of 2624	2764	Unicorn-41027.exe	39
PID 2764 wrote to memory of 2624	2764	Unicorn-41027.exe	39
PID 2420 wrote to memory of 1552	2420	Unicorn-27509.exe	42
PID 2420 wrote to memory of 1552	2420	Unicorn-27509.exe	42
PID 2420 wrote to memory of 1552	2420	Unicorn-27509.exe	42
PID 2420 wrote to memory of 1552	2420	Unicorn-27509.exe	42
PID 1856 wrote to memory of 1944	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	41
PID 1856 wrote to memory of 1944	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	41
PID 1856 wrote to memory of 1944	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	41
PID 1856 wrote to memory of 1944	1856	154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe	41
PID 2912 wrote to memory of 1808	2912	Unicorn-42916.exe	43
PID 2912 wrote to memory of 1808	2912	Unicorn-42916.exe	43
PID 2912 wrote to memory of 1808	2912	Unicorn-42916.exe	43
PID 2912 wrote to memory of 1808	2912	Unicorn-42916.exe	43
PID 2400 wrote to memory of 1640	2400	Unicorn-59627.exe	44
PID 2400 wrote to memory of 1640	2400	Unicorn-59627.exe	44
PID 2400 wrote to memory of 1640	2400	Unicorn-59627.exe	44
PID 2400 wrote to memory of 1640	2400	Unicorn-59627.exe	44
PID 2868 wrote to memory of 1884	2868	Unicorn-23207.exe	45
PID 2868 wrote to memory of 1884	2868	Unicorn-23207.exe	45
PID 2868 wrote to memory of 1884	2868	Unicorn-23207.exe	45
PID 2868 wrote to memory of 1884	2868	Unicorn-23207.exe	45
PID 2680 wrote to memory of 1548	2680	Unicorn-48676.exe	46
PID 2680 wrote to memory of 1548	2680	Unicorn-48676.exe	46
PID 2680 wrote to memory of 1548	2680	Unicorn-48676.exe	46
PID 2680 wrote to memory of 1548	2680	Unicorn-48676.exe	46

C:\Users\Admin\AppData\Local\Temp\154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe
"C:\Users\Admin\AppData\Local\Temp\154f8d1b0afa254080aadfc92ca144fc225451ba30c4ec26ab0fad0cc1155a73N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3197.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3197.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        9⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        10⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
        10⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        10⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
        10⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        9⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13259.exe
        9⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
        9⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
        8⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
        8⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34203.exe
        8⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24747.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28298.exe
        7⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        8⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        8⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15815.exe
        8⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        8⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        7⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
        7⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26948.exe
        7⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
        8⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17278.exe
        8⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11898.exe
        8⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        8⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exe
        8⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13365.exe
        7⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        7⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43217.exe
        6⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4702.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        7⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        8⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26977.exe
        8⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39330.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37133.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        7⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
        6⤵
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27135.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46511.exe
        5⤵
        
        PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31208.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36791.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        7⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58514.exe
        6⤵
        
        PID:648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23144.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        6⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
        7⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28964.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        6⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        5⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28835.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        6⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4838.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25302.exe
        5⤵
        
        PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        5⤵
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58522.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17389.exe
        6⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        7⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60434.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe
        6⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        5⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18962.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35801.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1583.exe
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12643.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61981.exe
        5⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47219.exe
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
      4⤵
      PID:6944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23207.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19485.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26417.exe
        7⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
        6⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59205.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34764.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        6⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
        7⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24151.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exe
        7⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58708.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
        5⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        6⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36666.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        5⤵
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34389.exe
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29934.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24457.exe
        6⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32919.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        5⤵
        
        PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        5⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        5⤵
        
        PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
      4⤵
      PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26173.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62746.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43483.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
      4⤵
      PID:6672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48676.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37718.exe
        6⤵
        Executes dropped EXE
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        7⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34830.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56075.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        5⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
        6⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19864.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        5⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7518.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50540.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        5⤵
        
        PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        6⤵
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        6⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exe
        6⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        5⤵
        
        PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1653.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53160.exe
      4⤵
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33969.exe
        5⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39043.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19230.exe
      4⤵
      PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
      4⤵
      PID:6960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33888.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9705.exe
        5⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        6⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25838.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        5⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
      4⤵
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        5⤵
        
        PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
      4⤵
      PID:968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
      4⤵
      PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5414.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30510.exe
      4⤵
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46017.exe
        5⤵
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5192.exe
        6⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46522.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31022.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        5⤵
        
        PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        5⤵
        
        PID:4452
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 236
        5⤵
        Program crash
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27135.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
      4⤵
      PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26948.exe
      4⤵
      PID:6784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
    3⤵
    PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29935.exe
      4⤵
      PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10248.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26417.exe
      4⤵
      PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
    3⤵
    PID:3816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3784.exe
    3⤵
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51419.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
    3⤵
    PID:6996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30702.exe
        7⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51063.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        8⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        6⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34203.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56185.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62274.exe
        7⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
        6⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        7⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        7⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        6⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        5⤵
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62407.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29217.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17668.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51682.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36047.exe
        6⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe
        7⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15815.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        6⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        5⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60568.exe
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
        6⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24707.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54752.exe
        5⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        5⤵
        
        PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28382.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34980.exe
        5⤵
        
        PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
      4⤵
      PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30650.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
      4⤵
      PID:6952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
        6⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16200.exe
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61554.exe
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42998.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22936.exe
        6⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16181.exe
        5⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27352.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        5⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        5⤵
        
        PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        5⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30876.exe
      4⤵
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47550.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54438.exe
        5⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
      4⤵
      PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9500.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39381.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48889.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        5⤵
        
        PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        5⤵
        
        PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
      4⤵
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21882.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
      4⤵
      PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
      4⤵
      PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
      4⤵
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
        5⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24134.exe
        5⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        5⤵
        
        PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe
      4⤵
      PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27545.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
      4⤵
      PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
      4⤵
      PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65409.exe
    3⤵
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
      4⤵
      PID:6424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
    3⤵
    PID:4284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47219.exe
    3⤵
    PID:5892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
    3⤵
    PID:6872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41027.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41027.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
        6⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15815.exe
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        6⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63545.exe
        5⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44047.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
        5⤵
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36242.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7000.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19026.exe
        5⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42998.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11350.exe
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        5⤵
        
        PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
      4⤵
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        5⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15229.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
      4⤵
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6699.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
      4⤵
      PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
      4⤵
      PID:6796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51682.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16200.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        5⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
      4⤵
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41416.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36666.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
      4⤵
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
      4⤵
      PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9412.exe
      4⤵
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
        5⤵
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15229.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28857.exe
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
    3⤵
    PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11350.exe
    3⤵
    PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
    3⤵
    PID:6720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55019.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        5⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
        6⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe
        5⤵
        
        PID:596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51374.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        5⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        5⤵
        
        PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
      4⤵
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        5⤵
        
        PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28460.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
      4⤵
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34345.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
      4⤵
      PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22936.exe
      4⤵
      PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30702.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        5⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
      4⤵
      PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      4⤵
      PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24747.exe
      4⤵
      PID:6428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
    3⤵
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
      4⤵
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
      4⤵
      PID:6320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
    3⤵
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
    3⤵
    PID:3292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
    3⤵
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
    3⤵
    PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9705.exe
      4⤵
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58193.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53595.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe
      4⤵
      PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
    3⤵
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33969.exe
      4⤵
      PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe
      4⤵
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
    3⤵
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
    3⤵
    PID:4484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8548.exe
    3⤵
    PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
    3⤵
    PID:6736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3566.exe
    3⤵
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49183.exe
      4⤵
      PID:7096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
    3⤵
    PID:1264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
    3⤵
    PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
    3⤵
    PID:5316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7682.exe
    3⤵
    PID:6416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
  2⤵
  PID:1976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
    3⤵
    PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
    3⤵
    PID:6992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
  2⤵
  PID:1440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18594.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18594.exe
  2⤵
  PID:3220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
  2⤵
  PID:4440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe
  2⤵
  PID:5848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
  2⤵
  PID:6888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-23207.exe

Filesize
468KB

MD5
e367d60bd6bbd2491f2c81c1e96176a2

SHA1
f1bf0a38ef23cbea6b769724bf6bd4565f2748bd

SHA256
350fbd2fe0f347e272b45bf0056836c234998aaa9360d1fb2cb0106105f07123

SHA512
108300750fd7fa7e89055d065e3a3b7381dac4297831ab18d00f0c2c967655d59ea3343b754f6f9c1397f374bf55840e6044a8b997655e23464ba4d015314cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23684.exe

Filesize
468KB

MD5
15cde38c6ec05e5e975aa5de4b11a0c4

SHA1
d393177402ac8170139949c675c616e3f4aeabc4

SHA256
5744aabdb0b82a4a301a3395f7054a0d9c97812f0e6985e4b1391e88bb6a7b5a

SHA512
0494896e7c5ef694ed1fa27d5f3eb2597daec12cc0f7219421303d66cdde3c9e55cc8f2ea027a71a0f8ff402025ef23b8997b53069d6c2b2738bff3169595222

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe

Filesize
468KB

MD5
96eecb06b1d61f0c0bc3d3b910f29653

SHA1
1880354ca6314a15d9a36187e2bf104c3c07d9ae

SHA256
cfa7243ac00ec341f689752901433216dc7cf92504b62f8a0f9aa39c48489b6a

SHA512
3cca954a69d2b64cc005f45f38fdc67c8483e9414290cc9df7b46e58860cbcaf31bc9a47f451bb2200c33f12b26fc7f79d4b58ea1bd28c7343b7eb4bb7b5fd2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe

Filesize
468KB

MD5
4dd54df6971405f1985b6f1965421963

SHA1
6cb1fe58b334023b0a1ecd9563207e31590c81d3

SHA256
6e0c41c7af061ff2a4f443da27672c7969911475f50110e25ca995837721d7e1

SHA512
d47dde5c1fd1490c2542e493d88fb797aba13f947f3debc2c2bbeb2dd938c2ae3ebbfd159e654681be6f999c510279042d5bd57b739791589b6c6e0d13f08d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe

Filesize
468KB

MD5
1d9ffd479d549033a8c8fe3e889cf8fb

SHA1
91d1748d5939ce50fc2ad5bd4942010dc2088f51

SHA256
bbbbbcff1c9fe890c86a14328926801c9d426783244f0775b05d14d64bcc93e3

SHA512
5cfc40f38c534f735e7b71fce76b553033c1b122f6697c8335ff575f3e48af26394ee9cd6a5e9cdc8fdea60b2877d0ece599fec50fbae6d775e1822b6003fad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe

Filesize
468KB

MD5
48fb6b136de1ebb601498da7079dd901

SHA1
b1d5ef87fe66b6ebcc309068de528cd1c2f6e1e0

SHA256
b926850ad21feae0c1a012827b892f4c13ca251907d55165f4b48454d9035237

SHA512
edecdc40bd70a49a3f3157a5241466b2975718ecba668cbf6d652fac7815ee2a8148812135ab8fb6e37e29e5a683218246d9858bf05d8aa4ae23f0e624edf9eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41027.exe

Filesize
468KB

MD5
b9177b7006f5e22be8cfca238dec1442

SHA1
5e6e35ef1944948edd8ee93350ea6de2979d3a4a

SHA256
c3802ebc61fff0e226e1de96dcba75c63016445ad38d5552e96c006f8aaf495c

SHA512
17f13b646b45a7ad1f99558104c29f5f29fc403960508586836865f3894f2fd54336aec4870abe7df4aeafdf7b0dd286a92183c3f621bfdceaacedd39873483e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe

Filesize
468KB

MD5
69d56d8acd0a4c98e8385e1f1165d7f2

SHA1
f644c285e5b05689979670ec4f2f892cad9e3c27

SHA256
7583b9b8aa2c6849bb29d1d4406cc81608c45ab57ccb5373c5c82f02a89d01bb

SHA512
ef9bab92d45ef4b0b44f25ac6f01af8d5fe6a35148444039519d1b24adb2821874051344856e1b47a908b7cd78ee63b5804a3de567ed03a59a1dd11c0e63c82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe

Filesize
468KB

MD5
73245a96ac33250ca870d79efa031af3

SHA1
eacdeb9d6e9304721ae1f82c7984df79e88abc92

SHA256
d075eb92edba0f5c5d4942350ce5ac246425bea6490a32d34458d59fbe45e999

SHA512
555453895854ba18f730794828bf296385b5698a404da6d1c9f32bdb6b35fb09b1664c545ff308ead16d4fce63f5d821ed7e8577a02be900d7bfe3246aca813a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe

Filesize
468KB

MD5
4c09ba9a89d70b3f4520fe7c766add58

SHA1
495b8970b4a1bfc2da45e6eebcfde0a68fb227e9

SHA256
89ccc416bb3d563fe1b62b5fe293ea94f090c2d9da76845a0dbb1cd5748a4537

SHA512
8e9599b068333e966a8963a280d12cc39231e863ce73c76feade0136340da55f0b69ebbde179e3eed045950b0de3dc0b883a16801f523cbc61159dd5f4bdda1d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe

Filesize
468KB

MD5
df8b8bd595c1cda4ec9304f3bbb86f89

SHA1
e81deb7b8c78f4aa77e6e350fa7798c0a326112c

SHA256
bd0b0fec03e78e406f30ebbe52ed9c2350f65f6f26b91c8ede3205952bd4fe08

SHA512
f35f74fb098595aa90f3011ac6bbf44d13699d414bd74b11de3838ab03d478aa92e17b4fd057fe611c02c89089a595597f24303cc36078d487df5022ac90f8d8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe

Filesize
468KB

MD5
11511ab0848b8e0ee5a4fcea6ba37af6

SHA1
2f383ccc746ebc130f4379843c3f93daec49c31c

SHA256
c7aea463f85aa299cda9140e40aa60830a5caa01ed2e19e162df8c41bcd17f03

SHA512
b1e467466f822be35430ec8bca7dd1d99f015d330bbd059dbe9133438a7094d3c754e7836a497d32c6d0a4bfd73b1677f3e58fc4294e5085573fba8946aef276

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31208.exe

Filesize
468KB

MD5
5d2fc5cdb72bdf84f2c3041ad75f73c3

SHA1
942aac6529a39e9c7ff9d10f7b6bc9986e0e5b46

SHA256
f0c197e570e73c3883961bca617458243eb0cab921f4e858890bada57f245316

SHA512
c95c6e465711f88aee77dfb2fc9522078fef523908efeb671fc5d6e315e22edeb530f4b645218b8a1e85539c0d8a896c0e62ddf52d7a8234772a096e6f310f09

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3197.exe

Filesize
468KB

MD5
8b1baa5eac017fc996a63e7eb8aeb6d2

SHA1
8a0fd80458a065e75d228684e84b67b7c43ba850

SHA256
6b33625996bf49c06608f3f05982713483a21e40202f520f3bf7366ac88a8192

SHA512
9608de24f629a86bdc16e2cebfe4ccd13b1e4dfe8f92b20a39d1130623690d573ec405596c3912d34f29386ce26f5226fd9de518b362754c1780e7d3140b4905

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe

Filesize
468KB

MD5
8e648429155592a4226600f998e47446

SHA1
36ab031920b9728548ff9f5bab661aec435f71ad

SHA256
bb639607b7dc4f3317874b8fbe6acda9bf194d737dc8554ff1ec546884d047f6

SHA512
0f3672f2ef4ebc6ad7a15f74ac7dbae4efc8b83b62c8e647d8bb47a074768d84a4468501fa67a6395af4b9c9f2c689ddaa77c82a9fe8b3c3d209f3d3b90bc09e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe

Filesize
468KB

MD5
70ff213f33140b63202fcad96c06fb3d

SHA1
c729da16076c62010b58aa373d87b181c98984fe

SHA256
191a6f70a0098ae58e3326b1eb0677b2182652e9aa7dad51450bdcd76b7a230f

SHA512
f6d13070ad9cd2e84cc841c38bb67cbb9fe0aad8b19dcdd1a7088549162ad970943ce6b21011e2c72a0b42e527ccbfc29d846ec1ee1033f774db995b351d64ce

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe

Filesize
468KB

MD5
c0513f1f76705367cf4f0eefa6f5e909

SHA1
8927c04e621392fb12d71c1648d1bd75af002fc7

SHA256
7b21e09125506e1a81a5033b8207432f5c1522d7cd76e4f96f5043a90b53cf72

SHA512
75b21000eaad7cda26cf1534f2a8457e6f0f6b23e1fbb14334c4194ed4dc4155894b215e4b10fb163c6fe8972c8e7647955c0c694ad32119acc2d752e212b0f4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48676.exe

Filesize
468KB

MD5
6eb0a3e5de9b4c54b3299f67c9cd26f5

SHA1
580e1d27a8d05d235713e26398ae6f37c1d60939

SHA256
bafb6986a5df25f435a3b10cfff794ccfb5e2764226d88eca89b76df83b09722

SHA512
bf02428cba3b55b5ea8bf906ff01015c80b504baed951e343d49142b121110ce50fc1749932e6debfb4e9ed0d058acc807e2709376013e5f784dab349f5e4dee

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe

Filesize
468KB

MD5
54108977b6e21c3f73dea7b8e44499fc

SHA1
0c2dd814341f19554d2bb3011da87900c97bde47

SHA256
eaec91130f74d3adf1d9879c450b7105471d255a4bcfdc58228808f4f6ff9a5a

SHA512
56d8ef692a5d12998636ebe3fcfa125dda7e4f2bb449f04b663a90aa100a3249f54aa8a0c1c63313660948985f5b5bc8a70a23aae66f369de27a955c51e29413

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe

Filesize
468KB

MD5
b9187c14718157e85c7a9c0c14470dd5

SHA1
adbc9f85fc85d08b306ca8726252fe715dddcfe1

SHA256
6f6aee34b0d2d0a01c47d4037f5cf34f13af806ce5184af2a4d912ffdeb2ed3a

SHA512
44fd3ccfbf7736e4aeea61636d38914ae47bc68c9a5d6e86a4620464f16d3efab8428194e5b7d63e8814b305fd61097aadb080dc095df6804d8a3a82485da418

Download Submit