2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
Size

468KB
MD5

e0c15c00b8398e419cc753c3b9818070
SHA1

0d0d8a5eaff120cbf19843f7d710807f05b8d825
SHA256

2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5
SHA512

3c556fd4716e8bb91b8adc067ee2af646b43f38a200b4c1cbb64bd2fcb15c973c685f9793f31d554bd7aa5f199e7932cdde858bcba178206e0bba0a18159ae4f
SSDEEP

3072:4belogxaIU57tbYZPzcfmNfD/n2DnpIH9QmyeQVqAf5Kkkicuxdl+:4b4oCc7tCP4fmNf+a7wf5D7cux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1512	Unicorn-27745.exe
1324	Unicorn-58279.exe
2060	Unicorn-8523.exe
2752	Unicorn-16858.exe
2756	Unicorn-47484.exe
2764	Unicorn-46515.exe
2832	Unicorn-26649.exe
2676	Unicorn-30345.exe
2492	Unicorn-59488.exe
1464	Unicorn-34237.exe
2792	Unicorn-32243.exe
688	Unicorn-52109.exe
2916	Unicorn-43484.exe
1564	Unicorn-37619.exe
1192	Unicorn-47880.exe
2204	Unicorn-40266.exe
1964	Unicorn-6847.exe
2364	Unicorn-29358.exe
2652	Unicorn-51070.exe
3032	Unicorn-3915.exe
628	Unicorn-24336.exe
1348	Unicorn-4470.exe
1036	Unicorn-35519.exe
2052	Unicorn-29388.exe
1960	Unicorn-61647.exe
544	Unicorn-15976.exe
792	Unicorn-2389.exe
2532	Unicorn-24144.exe
2032	Unicorn-51970.exe
2540	Unicorn-13702.exe
1652	Unicorn-42845.exe
2188	Unicorn-9426.exe
2400	Unicorn-9426.exe
1588	Unicorn-29332.exe
1580	Unicorn-43068.exe
2088	Unicorn-1066.exe
3004	Unicorn-2035.exe
2932	Unicorn-8165.exe
2072	Unicorn-56909.exe
2872	Unicorn-5233.exe
2224	Unicorn-62602.exe
2812	Unicorn-38652.exe
2776	Unicorn-19523.exe
2252	Unicorn-50158.exe
1220	Unicorn-62965.exe
580	Unicorn-17294.exe
2924	Unicorn-57372.exe
1376	Unicorn-40836.exe
696	Unicorn-8933.exe
1380	Unicorn-23223.exe
2520	Unicorn-33438.exe
1900	Unicorn-50329.exe
1152	Unicorn-57942.exe
1408	Unicorn-57942.exe
2852	Unicorn-33246.exe
2560	Unicorn-29716.exe
2416	Unicorn-51673.exe
3036	Unicorn-54745.exe
988	Unicorn-22097.exe
1636	Unicorn-14483.exe
764	Unicorn-50685.exe
880	Unicorn-36195.exe
2804	Unicorn-9460.exe
704	Unicorn-15857.exe

Loads dropped DLL 64 IoCs

pid	Process
1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
1512	Unicorn-27745.exe
1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
1512	Unicorn-27745.exe
2060	Unicorn-8523.exe
2060	Unicorn-8523.exe
1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
1512	Unicorn-27745.exe
1324	Unicorn-58279.exe
1512	Unicorn-27745.exe
1324	Unicorn-58279.exe
2752	Unicorn-16858.exe
2752	Unicorn-16858.exe
2060	Unicorn-8523.exe
2060	Unicorn-8523.exe
2764	Unicorn-46515.exe
2764	Unicorn-46515.exe
1324	Unicorn-58279.exe
2832	Unicorn-26649.exe
1324	Unicorn-58279.exe
2832	Unicorn-26649.exe
1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
1512	Unicorn-27745.exe
1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
1512	Unicorn-27745.exe
2676	Unicorn-30345.exe
2676	Unicorn-30345.exe
2752	Unicorn-16858.exe
2752	Unicorn-16858.exe
2492	Unicorn-59488.exe
2492	Unicorn-59488.exe
2756	Unicorn-47484.exe
2756	Unicorn-47484.exe
2060	Unicorn-8523.exe
2060	Unicorn-8523.exe
1464	Unicorn-34237.exe
1464	Unicorn-34237.exe
2792	Unicorn-32243.exe
2764	Unicorn-46515.exe
2792	Unicorn-32243.exe
2764	Unicorn-46515.exe
688	Unicorn-52109.exe
1324	Unicorn-58279.exe
688	Unicorn-52109.exe
1324	Unicorn-58279.exe
2832	Unicorn-26649.exe
1564	Unicorn-37619.exe
1564	Unicorn-37619.exe
2832	Unicorn-26649.exe
1512	Unicorn-27745.exe
1512	Unicorn-27745.exe
2916	Unicorn-43484.exe
2916	Unicorn-43484.exe
1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
1192	Unicorn-47880.exe
1192	Unicorn-47880.exe
2676	Unicorn-30345.exe
2676	Unicorn-30345.exe
1964	Unicorn-6847.exe
2364	Unicorn-29358.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	1220	WerFault.exe	75

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10461.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
1512	Unicorn-27745.exe
2060	Unicorn-8523.exe
1324	Unicorn-58279.exe
2752	Unicorn-16858.exe
2756	Unicorn-47484.exe
2764	Unicorn-46515.exe
2832	Unicorn-26649.exe
2676	Unicorn-30345.exe
2492	Unicorn-59488.exe
1464	Unicorn-34237.exe
2792	Unicorn-32243.exe
688	Unicorn-52109.exe
1564	Unicorn-37619.exe
2916	Unicorn-43484.exe
1192	Unicorn-47880.exe
2364	Unicorn-29358.exe
1964	Unicorn-6847.exe
2204	Unicorn-40266.exe
2652	Unicorn-51070.exe
628	Unicorn-24336.exe
3032	Unicorn-3915.exe
1960	Unicorn-61647.exe
1348	Unicorn-4470.exe
2052	Unicorn-29388.exe
544	Unicorn-15976.exe
1036	Unicorn-35519.exe
792	Unicorn-2389.exe
2532	Unicorn-24144.exe
2032	Unicorn-51970.exe
2540	Unicorn-13702.exe
1652	Unicorn-42845.exe
2400	Unicorn-9426.exe
2188	Unicorn-9426.exe
1580	Unicorn-43068.exe
1588	Unicorn-29332.exe
2088	Unicorn-1066.exe
2932	Unicorn-8165.exe
3004	Unicorn-2035.exe
2072	Unicorn-56909.exe
2812	Unicorn-38652.exe
2224	Unicorn-62602.exe
2872	Unicorn-5233.exe
2776	Unicorn-19523.exe
2252	Unicorn-50158.exe
580	Unicorn-17294.exe
1220	Unicorn-62965.exe
2924	Unicorn-57372.exe
696	Unicorn-8933.exe
1380	Unicorn-23223.exe
1376	Unicorn-40836.exe
2520	Unicorn-33438.exe
1900	Unicorn-50329.exe
1152	Unicorn-57942.exe
1408	Unicorn-57942.exe
2852	Unicorn-33246.exe
2560	Unicorn-29716.exe
2416	Unicorn-51673.exe
3036	Unicorn-54745.exe
988	Unicorn-22097.exe
1636	Unicorn-14483.exe
764	Unicorn-50685.exe
880	Unicorn-36195.exe
1996	Unicorn-21988.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1512	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	30
PID 1732 wrote to memory of 1512	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	30
PID 1732 wrote to memory of 1512	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	30
PID 1732 wrote to memory of 1512	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	30
PID 1732 wrote to memory of 1324	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	32
PID 1732 wrote to memory of 1324	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	32
PID 1732 wrote to memory of 1324	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	32
PID 1732 wrote to memory of 1324	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	32
PID 1512 wrote to memory of 2060	1512	Unicorn-27745.exe	31
PID 1512 wrote to memory of 2060	1512	Unicorn-27745.exe	31
PID 1512 wrote to memory of 2060	1512	Unicorn-27745.exe	31
PID 1512 wrote to memory of 2060	1512	Unicorn-27745.exe	31
PID 2060 wrote to memory of 2752	2060	Unicorn-8523.exe	33
PID 2060 wrote to memory of 2752	2060	Unicorn-8523.exe	33
PID 2060 wrote to memory of 2752	2060	Unicorn-8523.exe	33
PID 2060 wrote to memory of 2752	2060	Unicorn-8523.exe	33
PID 1732 wrote to memory of 2756	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	34
PID 1732 wrote to memory of 2756	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	34
PID 1732 wrote to memory of 2756	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	34
PID 1732 wrote to memory of 2756	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	34
PID 1512 wrote to memory of 2832	1512	Unicorn-27745.exe	35
PID 1512 wrote to memory of 2832	1512	Unicorn-27745.exe	35
PID 1512 wrote to memory of 2832	1512	Unicorn-27745.exe	35
PID 1512 wrote to memory of 2832	1512	Unicorn-27745.exe	35
PID 1324 wrote to memory of 2764	1324	Unicorn-58279.exe	36
PID 1324 wrote to memory of 2764	1324	Unicorn-58279.exe	36
PID 1324 wrote to memory of 2764	1324	Unicorn-58279.exe	36
PID 1324 wrote to memory of 2764	1324	Unicorn-58279.exe	36
PID 2752 wrote to memory of 2676	2752	Unicorn-16858.exe	38
PID 2752 wrote to memory of 2676	2752	Unicorn-16858.exe	38
PID 2752 wrote to memory of 2676	2752	Unicorn-16858.exe	38
PID 2752 wrote to memory of 2676	2752	Unicorn-16858.exe	38
PID 2060 wrote to memory of 2492	2060	Unicorn-8523.exe	39
PID 2060 wrote to memory of 2492	2060	Unicorn-8523.exe	39
PID 2060 wrote to memory of 2492	2060	Unicorn-8523.exe	39
PID 2060 wrote to memory of 2492	2060	Unicorn-8523.exe	39
PID 2764 wrote to memory of 1464	2764	Unicorn-46515.exe	40
PID 2764 wrote to memory of 1464	2764	Unicorn-46515.exe	40
PID 2764 wrote to memory of 1464	2764	Unicorn-46515.exe	40
PID 2764 wrote to memory of 1464	2764	Unicorn-46515.exe	40
PID 1324 wrote to memory of 2792	1324	Unicorn-58279.exe	41
PID 1324 wrote to memory of 2792	1324	Unicorn-58279.exe	41
PID 1324 wrote to memory of 2792	1324	Unicorn-58279.exe	41
PID 1324 wrote to memory of 2792	1324	Unicorn-58279.exe	41
PID 2832 wrote to memory of 688	2832	Unicorn-26649.exe	42
PID 2832 wrote to memory of 688	2832	Unicorn-26649.exe	42
PID 2832 wrote to memory of 688	2832	Unicorn-26649.exe	42
PID 2832 wrote to memory of 688	2832	Unicorn-26649.exe	42
PID 1732 wrote to memory of 2916	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	43
PID 1732 wrote to memory of 2916	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	43
PID 1732 wrote to memory of 2916	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	43
PID 1732 wrote to memory of 2916	1732	2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe	43
PID 1512 wrote to memory of 1564	1512	Unicorn-27745.exe	44
PID 1512 wrote to memory of 1564	1512	Unicorn-27745.exe	44
PID 1512 wrote to memory of 1564	1512	Unicorn-27745.exe	44
PID 1512 wrote to memory of 1564	1512	Unicorn-27745.exe	44
PID 2676 wrote to memory of 1192	2676	Unicorn-30345.exe	45
PID 2676 wrote to memory of 1192	2676	Unicorn-30345.exe	45
PID 2676 wrote to memory of 1192	2676	Unicorn-30345.exe	45
PID 2676 wrote to memory of 1192	2676	Unicorn-30345.exe	45
PID 2752 wrote to memory of 2204	2752	Unicorn-16858.exe	46
PID 2752 wrote to memory of 2204	2752	Unicorn-16858.exe	46
PID 2752 wrote to memory of 2204	2752	Unicorn-16858.exe	46
PID 2752 wrote to memory of 2204	2752	Unicorn-16858.exe	46

C:\Users\Admin\AppData\Local\Temp\2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe
"C:\Users\Admin\AppData\Local\Temp\2f214f7cf873095ddbbee3ede1d670006ced0531567a19f7ed12902b3be05ce5N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8523.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22097.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38459.exe
        9⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        9⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39995.exe
        9⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        8⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        8⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        8⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
        8⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14483.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
        8⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51012.exe
        9⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        9⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        9⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57083.exe
        9⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        9⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
        8⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        8⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        8⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
        8⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
        7⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50685.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44733.exe
        8⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        8⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
        8⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        7⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52055.exe
        8⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        8⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        8⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        7⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29251.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2787.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34957.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        7⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36195.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43228.exe
        7⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        7⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
        6⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12060.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40266.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        7⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        8⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        8⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        8⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        8⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
        7⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46714.exe
        8⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        7⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        6⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56487.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23850.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21017.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
        7⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12412.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21722.exe
        5⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
        6⤵
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        6⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8191.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46907.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59488.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6847.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9426.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9460.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
        8⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        8⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14083.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
        7⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        6⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
        7⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        7⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        6⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55437.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45287.exe
        7⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
        7⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12027.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22029.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49288.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55435.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        6⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        5⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        6⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        6⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31718.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        5⤵
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51070.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        6⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23625.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        5⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39144.exe
        6⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12401.exe
        5⤵
        
        PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
        5⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
        6⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56228.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11770.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55799.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-777.exe
        7⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15614.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23459.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17000.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        5⤵
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64645.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4619.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-618.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-710.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41471.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6098.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
      4⤵
      PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35519.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30156.exe
        7⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10856.exe
        8⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        8⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        8⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1598.exe
        7⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9598.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        7⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64919.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        7⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        7⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11891.exe
        7⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61540.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27098.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        6⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52143.exe
        7⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9598.exe
        7⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        7⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
        6⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63769.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44692.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        5⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43315.exe
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4254.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25911.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62602.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39995.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        5⤵
        
        PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        5⤵
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19523.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29274.exe
        5⤵
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1287.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3362.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
        5⤵
        
        PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26176.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17245.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
      4⤵
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37333.exe
      4⤵
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59725.exe
      4⤵
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37619.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62605.exe
        6⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        6⤵
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50716.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        5⤵
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2806.exe
      4⤵
      PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2389.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        5⤵
        
        PID:708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39912.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26176.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        7⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
        7⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32933.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43289.exe
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
      4⤵
      PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6170.exe
      4⤵
      PID:940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57613.exe
      4⤵
      PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
      4⤵
      PID:6788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
      4⤵
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        5⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        5⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        5⤵
        
        PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
      4⤵
      PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
      4⤵
      PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
    3⤵
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25921.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
      4⤵
      PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
      4⤵
      PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56888.exe
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
    3⤵
    PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
    3⤵
    PID:6300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3915.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        7⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        7⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15614.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44263.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1220
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 200
        6⤵
        Program crash
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
        5⤵
        
        PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        6⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        6⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33720.exe
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21038.exe
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
      4⤵
      PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
      4⤵
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
      4⤵
      PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24336.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        6⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-524.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39657.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        6⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        5⤵
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27098.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19951.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38652.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        5⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        6⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46248.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40798.exe
        5⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42611.exe
        5⤵
        
        PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
      4⤵
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        5⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28194.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57649.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43857.exe
      4⤵
      PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27629.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19570.exe
      4⤵
      PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29388.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33246.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        5⤵
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15614.exe
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
      4⤵
      PID:6268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
      4⤵
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20045.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18277.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe
      4⤵
      PID:5516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13057.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
      4⤵
      PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exe
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
    3⤵
    PID:4820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
    3⤵
    PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9426.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        5⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44318.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52364.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        5⤵
        
        PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
      4⤵
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        5⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        5⤵
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
      4⤵
      PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
      4⤵
      PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
      4⤵
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49168.exe
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23625.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6170.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57613.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
      4⤵
      PID:6716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21722.exe
    3⤵
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
      4⤵
      PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23625.exe
      4⤵
      PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23052.exe
    3⤵
    PID:3156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
    3⤵
    PID:5452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2850.exe
    3⤵
    PID:6360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43484.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43484.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35584.exe
        5⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57177.exe
        6⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe
        7⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        6⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
        5⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
      4⤵
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
        5⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28961.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
        5⤵
        
        PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25359.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45522.exe
      4⤵
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
      4⤵
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
      4⤵
      PID:6308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
      4⤵
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        5⤵
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3973.exe
        5⤵
        
        PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15152.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exe
      4⤵
      PID:6380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe
    3⤵
    PID:676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6170.exe
    3⤵
    PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
    3⤵
    PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
    3⤵
    PID:6852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
    3⤵
    PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
      4⤵
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
      4⤵
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52999.exe
      4⤵
      PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62890.exe
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
    3⤵
    PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
    3⤵
    PID:4648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27629.exe
    3⤵
    PID:4360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
    3⤵
    PID:7156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40836.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40836.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
    3⤵
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
    3⤵
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
    3⤵
    PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
    3⤵
    PID:6612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
  2⤵
  PID:1328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
  2⤵
  PID:3388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
  2⤵
  PID:4608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
  2⤵
  PID:5228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
  2⤵
  PID:5728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe

Filesize
468KB

MD5
d6052942f8a31011dd407b1c0ce1a166

SHA1
d2d26a95a15e21aa3bd6500e108928ffb0e7c922

SHA256
4280d276afac954b28322ede753bd278e92584d9f29e80ef89b90fc4a0608c2c

SHA512
73513f93a8e169a9565c3534c601b57f3f91e3527acd93c6027e76f6a5c88f8bfa4784e7e67fe84afdf72dae8af800480489a10b1712d897d609efe9590f8a43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37619.exe

Filesize
468KB

MD5
d5fb7804e99acb17ff8b557bf597879d

SHA1
0a5b7172ec8d9422e41ea3f03bd0f368c080e991

SHA256
60f38aa0db2831b7f42cfe133da93c7077da201c6e1b5b6d738803b9210adbdb

SHA512
72cbff66fb691760f594d86e2d2d9d65878d98f8d3364f40a2de7428aa8b36f795cfd44b6dd9c2a5ca85f5dad240bf2f2416ed83c6089ef6bfeebfa643308a5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52143.exe

Filesize
468KB

MD5
9838c16c55537f4dc85544f5d2cca7a8

SHA1
1f7a27f011c13b88af094f81a367c211474ceacf

SHA256
342af17fff33892528cbb3ec703034b69a88bfad1a5881c95a681583321ff367

SHA512
c3ee80f8970f731b9c6381efa0bf4bca644d19a9217864f4d53dafd3fc3d537cbd4a2ad2c81ee67c24c04527af9e48e440612dcd9758a9bee8b7ad232956e2d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe

Filesize
468KB

MD5
b0a761a30c55dbc76297b39a1e95ded0

SHA1
5609bb186e14f62c3a288bb55fcce23b1bf33e7a

SHA256
986e803b2a23c05c988732ebce1921e6f3686a380347ab7152201c2f51a891f2

SHA512
ff7d2f0269d1355f26833ff1223f809fbaf3aa7f4ce7e6b08aa33853c8ffbcb74b6a9af75e4152c867a0e23edcba0ce6936902dee3578bc3d78b681c34564568

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe

Filesize
468KB

MD5
879f2e1fd41119eddbe3be7950dbbb99

SHA1
384ed7ff7080f855090ccfb04ea4b77631108db5

SHA256
883c1f53a7b4801f8d50a1f6d91424cc83c5375ad92bb1803e5d58bc53d4c044

SHA512
926eb2a05f0496f0927b679af87976589e57be19807bf78a58491e4f845e47fdf1998a03296a75c6a1f1c40605e31d72f03f78d920ed91d89cd82c572cbdfb76

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe

Filesize
468KB

MD5
40dd1377fbd1abe31b07b222efa74215

SHA1
3b4b3a2639e445b8d37155a462b52348dcf9d0ee

SHA256
76a754be9eb6c6f5464ae4b9077c1252471bb2f35039212e7990165dcee20d02

SHA512
a17f6aa8db65aa78a419b6a34f5b8546afb0b3c077465b111e1c57fb64ba3170fc1187e3b5ade103ccb387de00990afa1d51e0cb85b6af0409f7bfc115a10ce8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe

Filesize
468KB

MD5
8b1ee9fafd105d51c3857a604098df0f

SHA1
bc38051a4038c6b19012fe119fed0f1fbb61b61c

SHA256
97a394d05d9a015d6e5a9a5120d720fd8cb6e3ac2afff15d5921dd67f8ff93ac

SHA512
896e2eb8b6a19c3cc960b062f43c3f8ef7a51fcc29d329c9abf3d89663c569bf5fd098c39b3e5174d6c25bf2ac15eaced5841ad90eca00118dbafb47f208b478

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe

Filesize
468KB

MD5
8fd9c63c75f8fb6873ce25ed8c4060bd

SHA1
c7bdd10367bf12d986c12d527d20899630f5da47

SHA256
39bfc6fa66424c65c6d3356194f9e3d0cb1e42ce092330937fa41754b0d7244e

SHA512
9550587c87b4afcd772208d63643ddaf63708ed260434126aba23935aa4c25f47ef2137cef36b41e6a21312106eb5ecbd9f5118940b0e44a12d3dd837dcff386

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe

Filesize
468KB

MD5
a566b63f23fef4f4dc6fffcfb0661c61

SHA1
d7a41a26c74fdf376422736a35487301d9a2d607

SHA256
2eccad143c998df56b7700387e1ce6afbea6e1ffd127371517c53c75813bb1d3

SHA512
d6b0595c981980db95203eedc3fedab778de750341090e3e9dfb41b6ebc5488218c083b819c24e52baec66f86fa8568a4cbe5e3f6a96220f401d63abdb840107

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe

Filesize
468KB

MD5
38beb51321e890a1744d220b170bafc8

SHA1
6a35d27d968dd747d677e8a8c34edef8432ca2d2

SHA256
4d23f9a051cf04cba020a57c140b35de11ac1a0642b78abcbe941536bc2cea5d

SHA512
5b021999c453734fa8f26c0bf0ad969c4100d50734b5f35eb0793ab03d7218aa3d883a2ba2077eea8bc94350253820924bc4756e3b7ce1cbef6804a0831548f5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40266.exe

Filesize
468KB

MD5
1c4d1e70fee253c1f21f0682b997870d

SHA1
144a9c7baae4f930fe434310a639104b5e55a2b6

SHA256
e01ae2d07dbb140374820baf035ed2bf6351f75947e8f5460d7fbb6a97766e72

SHA512
0d95c715c0a48482aa6f6ba6d44f1044a88494078f7ff8cf811f8bbee5796547cb916d64373d4c5fbb1c5c36230d60582934ae579dd8c42457af7db6c34fbe68

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43484.exe

Filesize
468KB

MD5
2b685c0b88550878526bec1106b9cfcf

SHA1
116ea71bbe6d6d98b53d23e494e0843a4b312b74

SHA256
c4c99ab426cc6cf63eca8ee565b85fed8aba8b711c1e62ae935034a4ed1cb83e

SHA512
ad2fee66b546b404eaae6d7a815f32dde4269bcaa97204b6de8045418300393f3d8383d4d739e461a28ddbe6750c0f784120948cc560912341fad7fcbc8827ad

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe

Filesize
468KB

MD5
9631bdad9e105950b745b6a85dabc7db

SHA1
e75d4f3cdd375e81da3fae47664beac110c7bfde

SHA256
62f83b5b6e60d05907bc1d9355169e913e2b90d0cfd3d923d390cec17a2efc34

SHA512
ecbeeb9de633208919015b982cd8d1a071d60adee39e1ba32bf1d84c13128cdedbe72d5b341f41d9358dd063ec1a8cc7d71b879d26eedc65019b8345164bd807

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe

Filesize
468KB

MD5
bd9c9a1c8e6e1d04267a873fc64146f3

SHA1
2ea0dcbf144025812a978e115d3a8a5cb17dc6e8

SHA256
c8bc87dcefcb0657a3c178f78bdab592a0b6646e88a16ea886f814bd34f4d796

SHA512
80cf13171cabcbb1e61d6e8cab98d71f514ab050616ac549a153e17f31d0c0fcc16b4f7ea734b711879cb709185f541469660163ac1efd63c6b45c565404f509

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe

Filesize
468KB

MD5
17a0ac61fd730a898e09168efb980dad

SHA1
efcd7a8f97cd79c723400611b688da54ae6a1756

SHA256
ef734259aeeddb42e862d79ff4efe393779ee75b99526dd31303f75496ee0457

SHA512
79cbd68c462f3890a24ece231af863618d336657644b92769b878b120c396d43f833108b93e1089680466e13c9d9fb69ef10c999e711d49c9fbbf64481096fd0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe

Filesize
468KB

MD5
9779404cf108fe66846389d7d9ad3352

SHA1
7960143174e499ec65bb5895765063feae4dfff3

SHA256
eef0fab8eb30b75657236ecf71e409b342330274b6a7abf67851592a03296ae1

SHA512
5cc2bc41a011c70590da50ca383416210c3cf979a5ecebfe8e85f4d8ad0d1c60c4c8230f0158ee81f6881bba1f60cdbe04093c06af4e0c75b0a101111e63f06e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe

Filesize
468KB

MD5
672ceed83b00489315a54680f1d29243

SHA1
3d995bb64cca8a581de3f57e9759bdcb30bcede5

SHA256
05fbbb53cd95ec81dafc60abd95334d018f054ff37a3d1a0ac7e8c0d1aea404c

SHA512
721b3a359c19099cd8e9196db1102d0c4f10bd57af7e0e30a1626006fa05d0152f70a8baf570c4018c5b90a509850403c6f1ccdcc3e8edd23a53ebf331d8083c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59488.exe

Filesize
468KB

MD5
49bd20283c64857214d55489ddbd9cf4

SHA1
15e2a77c7e4d19a467cb50eb11c6340f692650fe

SHA256
4841b9b6010aa63e625c4e4e16bd634a76e6bab765d33ee9353b199c7f9e18fe

SHA512
2ec2a3aa3dc18777df37c41ebeabb55f41d6cf974e79224ced493658682559435bf05c0563c0881e03b4cb313214a16e344c4ff9939f826f3c4ea6b4faa8193d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6847.exe

Filesize
468KB

MD5
a5385b0bfbf7d8042671958ffef828c1

SHA1
d5d77d3d066b21759b010ee3e15cf0ec6eae4f2d

SHA256
e04039cd5276fd8bb324c1de7debe3de69a8bfe798d3f6dd3f9b2a7da0586133

SHA512
e8c00179108448709ad6126b275f8ec8289b4039c39276169eaf5614fcea765ad9ed2dc7c23dde2427b5c804fa09d2792d4a12cfa21a774a140d1be52ae2b74a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8523.exe

Filesize
468KB

MD5
cd136897118de8c275291c1a2c3ed59a

SHA1
f997c80506795606f5afc4a4f75dad90b3a28855

SHA256
b3e11e95ac8b3c40b74ad31fb9b29aabdfcfe64b887d7779e7c2b52f37b56c3b

SHA512
9ef17bd57759c8f5b065ec7d80e0d7cb794095bc8fa5307ee04aad8d54f99563e3eb2024b8d74af15a5eb881f1e20cf950a610091cac268a5b69bf773aad7f2e

Download Submit