4cc1ae54b363b329f91ed086707f3a4ef2467a5f847140b07ca2c27637e94829

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d40b6b81d537a9551d1aa4021c455c20N.exe
Size

468KB
MD5

d40b6b81d537a9551d1aa4021c455c20
SHA1

4390f2eb2738fdca3646ef26c328791c4a9e7a19
SHA256

4cc1ae54b363b329f91ed086707f3a4ef2467a5f847140b07ca2c27637e94829
SHA512

289e2d3f7c72f7fc4dae2c96a7454e635879acacded680d084bd80df3d329ba3d21aaa23496e6ed499ed7fb9cdea8b54d293eecbaea8b8be3eccd3704a23fb50
SSDEEP

3072:lbF4ogJRRzKBebYtPzWyOp8/ECO2ZnWlMmHhUEtRHQ7MGXyhglEC:lbao8OBeiPCyOpAWXBHQoMyhg

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2756	Unicorn-61082.exe
2684	Unicorn-27279.exe
2584	Unicorn-64782.exe
2596	Unicorn-30652.exe
2564	Unicorn-55903.exe
2384	Unicorn-50880.exe
1660	Unicorn-36582.exe
2940	Unicorn-2001.exe
2536	Unicorn-27252.exe
684	Unicorn-47118.exe
2016	Unicorn-52281.exe
1632	Unicorn-36764.exe
1084	Unicorn-56630.exe
868	Unicorn-50500.exe
1144	Unicorn-52546.exe
2176	Unicorn-54575.exe
2508	Unicorn-31969.exe
2232	Unicorn-55535.exe
2492	Unicorn-30647.exe
2344	Unicorn-10781.exe
2812	Unicorn-18395.exe
884	Unicorn-64066.exe
856	Unicorn-10226.exe
1324	Unicorn-49213.exe
1708	Unicorn-38245.exe
1712	Unicorn-47175.exe
1956	Unicorn-19141.exe
1860	Unicorn-31991.exe
1136	Unicorn-32795.exe
1284	Unicorn-58725.exe
2832	Unicorn-46848.exe
2476	Unicorn-59847.exe
1700	Unicorn-54824.exe
3020	Unicorn-7853.exe
2748	Unicorn-62992.exe
1812	Unicorn-39727.exe
2104	Unicorn-19307.exe
2112	Unicorn-19307.exe
1704	Unicorn-52733.exe
2624	Unicorn-28229.exe
2096	Unicorn-63131.exe
3064	Unicorn-44108.exe
2724	Unicorn-19869.exe
1424	Unicorn-7616.exe
2892	Unicorn-57372.exe
2288	Unicorn-25798.exe
840	Unicorn-31929.exe
1240	Unicorn-31929.exe
2856	Unicorn-35556.exe
2876	Unicorn-26890.exe
320	Unicorn-35821.exe
2988	Unicorn-52904.exe
1612	Unicorn-7232.exe
1852	Unicorn-16745.exe
2228	Unicorn-16745.exe
2172	Unicorn-963.exe
2864	Unicorn-10614.exe
2380	Unicorn-15591.exe
2492	Unicorn-21191.exe
2432	Unicorn-43086.exe
912	Unicorn-1861.exe
1888	Unicorn-47533.exe
1536	Unicorn-32679.exe
1720	Unicorn-34726.exe

Loads dropped DLL 64 IoCs

pid	Process
2012	d40b6b81d537a9551d1aa4021c455c20N.exe
2012	d40b6b81d537a9551d1aa4021c455c20N.exe
2756	Unicorn-61082.exe
2756	Unicorn-61082.exe
2012	d40b6b81d537a9551d1aa4021c455c20N.exe
2012	d40b6b81d537a9551d1aa4021c455c20N.exe
2684	Unicorn-27279.exe
2684	Unicorn-27279.exe
2756	Unicorn-61082.exe
2756	Unicorn-61082.exe
2584	Unicorn-64782.exe
2584	Unicorn-64782.exe
2012	d40b6b81d537a9551d1aa4021c455c20N.exe
2012	d40b6b81d537a9551d1aa4021c455c20N.exe
2596	Unicorn-30652.exe
2596	Unicorn-30652.exe
2384	Unicorn-50880.exe
2384	Unicorn-50880.exe
2684	Unicorn-27279.exe
2684	Unicorn-27279.exe
2756	Unicorn-61082.exe
2564	Unicorn-55903.exe
2584	Unicorn-64782.exe
2012	d40b6b81d537a9551d1aa4021c455c20N.exe
2584	Unicorn-64782.exe
2564	Unicorn-55903.exe
2756	Unicorn-61082.exe
1660	Unicorn-36582.exe
2012	d40b6b81d537a9551d1aa4021c455c20N.exe
1660	Unicorn-36582.exe
2940	Unicorn-2001.exe
2940	Unicorn-2001.exe
2596	Unicorn-30652.exe
2596	Unicorn-30652.exe
1084	Unicorn-56630.exe
1084	Unicorn-56630.exe
2564	Unicorn-55903.exe
684	Unicorn-47118.exe
2564	Unicorn-55903.exe
684	Unicorn-47118.exe
2016	Unicorn-52281.exe
2016	Unicorn-52281.exe
2384	Unicorn-50880.exe
2384	Unicorn-50880.exe
1144	Unicorn-52546.exe
1144	Unicorn-52546.exe
2684	Unicorn-27279.exe
2684	Unicorn-27279.exe
2012	d40b6b81d537a9551d1aa4021c455c20N.exe
2012	d40b6b81d537a9551d1aa4021c455c20N.exe
868	Unicorn-50500.exe
868	Unicorn-50500.exe
1660	Unicorn-36582.exe
1660	Unicorn-36582.exe
1632	Unicorn-36764.exe
1632	Unicorn-36764.exe
2756	Unicorn-61082.exe
2756	Unicorn-61082.exe
2584	Unicorn-64782.exe
2584	Unicorn-64782.exe
2176	Unicorn-54575.exe
2176	Unicorn-54575.exe
2940	Unicorn-2001.exe
2940	Unicorn-2001.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5980	2132	WerFault.exe	138

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-763.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2012	d40b6b81d537a9551d1aa4021c455c20N.exe
2756	Unicorn-61082.exe
2684	Unicorn-27279.exe
2584	Unicorn-64782.exe
2596	Unicorn-30652.exe
2564	Unicorn-55903.exe
2384	Unicorn-50880.exe
1660	Unicorn-36582.exe
2940	Unicorn-2001.exe
684	Unicorn-47118.exe
2536	Unicorn-27252.exe
2016	Unicorn-52281.exe
1084	Unicorn-56630.exe
868	Unicorn-50500.exe
1632	Unicorn-36764.exe
1144	Unicorn-52546.exe
2176	Unicorn-54575.exe
2508	Unicorn-31969.exe
2232	Unicorn-55535.exe
2344	Unicorn-10781.exe
884	Unicorn-64066.exe
2812	Unicorn-18395.exe
856	Unicorn-10226.exe
1324	Unicorn-49213.exe
1708	Unicorn-38245.exe
1712	Unicorn-47175.exe
1956	Unicorn-19141.exe
1860	Unicorn-31991.exe
1136	Unicorn-32795.exe
1284	Unicorn-58725.exe
2832	Unicorn-46848.exe
2476	Unicorn-59847.exe
1700	Unicorn-54824.exe
3020	Unicorn-7853.exe
2748	Unicorn-62992.exe
1812	Unicorn-39727.exe
2104	Unicorn-19307.exe
2112	Unicorn-19307.exe
1704	Unicorn-52733.exe
2096	Unicorn-63131.exe
2624	Unicorn-28229.exe
3064	Unicorn-44108.exe
2724	Unicorn-19869.exe
2288	Unicorn-25798.exe
2892	Unicorn-57372.exe
1424	Unicorn-7616.exe
1240	Unicorn-31929.exe
840	Unicorn-31929.exe
2876	Unicorn-26890.exe
320	Unicorn-35821.exe
2856	Unicorn-35556.exe
2988	Unicorn-52904.exe
1612	Unicorn-7232.exe
2172	Unicorn-963.exe
1852	Unicorn-16745.exe
2228	Unicorn-16745.exe
2864	Unicorn-10614.exe
2380	Unicorn-15591.exe
2492	Unicorn-21191.exe
2432	Unicorn-43086.exe
1888	Unicorn-47533.exe
912	Unicorn-1861.exe
1536	Unicorn-32679.exe
1720	Unicorn-34726.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2756	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	31
PID 2012 wrote to memory of 2756	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	31
PID 2012 wrote to memory of 2756	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	31
PID 2012 wrote to memory of 2756	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	31
PID 2756 wrote to memory of 2684	2756	Unicorn-61082.exe	32
PID 2756 wrote to memory of 2684	2756	Unicorn-61082.exe	32
PID 2756 wrote to memory of 2684	2756	Unicorn-61082.exe	32
PID 2756 wrote to memory of 2684	2756	Unicorn-61082.exe	32
PID 2012 wrote to memory of 2584	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	33
PID 2012 wrote to memory of 2584	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	33
PID 2012 wrote to memory of 2584	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	33
PID 2012 wrote to memory of 2584	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	33
PID 2684 wrote to memory of 2596	2684	Unicorn-27279.exe	34
PID 2684 wrote to memory of 2596	2684	Unicorn-27279.exe	34
PID 2684 wrote to memory of 2596	2684	Unicorn-27279.exe	34
PID 2684 wrote to memory of 2596	2684	Unicorn-27279.exe	34
PID 2756 wrote to memory of 2564	2756	Unicorn-61082.exe	35
PID 2756 wrote to memory of 2564	2756	Unicorn-61082.exe	35
PID 2756 wrote to memory of 2564	2756	Unicorn-61082.exe	35
PID 2756 wrote to memory of 2564	2756	Unicorn-61082.exe	35
PID 2584 wrote to memory of 2384	2584	Unicorn-64782.exe	36
PID 2584 wrote to memory of 2384	2584	Unicorn-64782.exe	36
PID 2584 wrote to memory of 2384	2584	Unicorn-64782.exe	36
PID 2584 wrote to memory of 2384	2584	Unicorn-64782.exe	36
PID 2012 wrote to memory of 1660	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	37
PID 2012 wrote to memory of 1660	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	37
PID 2012 wrote to memory of 1660	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	37
PID 2012 wrote to memory of 1660	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	37
PID 2596 wrote to memory of 2940	2596	Unicorn-30652.exe	38
PID 2596 wrote to memory of 2940	2596	Unicorn-30652.exe	38
PID 2596 wrote to memory of 2940	2596	Unicorn-30652.exe	38
PID 2596 wrote to memory of 2940	2596	Unicorn-30652.exe	38
PID 2384 wrote to memory of 684	2384	Unicorn-50880.exe	39
PID 2384 wrote to memory of 684	2384	Unicorn-50880.exe	39
PID 2384 wrote to memory of 684	2384	Unicorn-50880.exe	39
PID 2384 wrote to memory of 684	2384	Unicorn-50880.exe	39
PID 2684 wrote to memory of 2536	2684	Unicorn-27279.exe	40
PID 2684 wrote to memory of 2536	2684	Unicorn-27279.exe	40
PID 2684 wrote to memory of 2536	2684	Unicorn-27279.exe	40
PID 2684 wrote to memory of 2536	2684	Unicorn-27279.exe	40
PID 2584 wrote to memory of 1632	2584	Unicorn-64782.exe	43
PID 2584 wrote to memory of 1632	2584	Unicorn-64782.exe	43
PID 2584 wrote to memory of 1632	2584	Unicorn-64782.exe	43
PID 2584 wrote to memory of 1632	2584	Unicorn-64782.exe	43
PID 2756 wrote to memory of 868	2756	Unicorn-61082.exe	41
PID 2756 wrote to memory of 868	2756	Unicorn-61082.exe	41
PID 2756 wrote to memory of 868	2756	Unicorn-61082.exe	41
PID 2756 wrote to memory of 868	2756	Unicorn-61082.exe	41
PID 2012 wrote to memory of 2016	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	44
PID 2012 wrote to memory of 2016	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	44
PID 2012 wrote to memory of 2016	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	44
PID 2012 wrote to memory of 2016	2012	d40b6b81d537a9551d1aa4021c455c20N.exe	44
PID 2564 wrote to memory of 1084	2564	Unicorn-55903.exe	42
PID 2564 wrote to memory of 1084	2564	Unicorn-55903.exe	42
PID 2564 wrote to memory of 1084	2564	Unicorn-55903.exe	42
PID 2564 wrote to memory of 1084	2564	Unicorn-55903.exe	42
PID 1660 wrote to memory of 1144	1660	Unicorn-36582.exe	45
PID 1660 wrote to memory of 1144	1660	Unicorn-36582.exe	45
PID 1660 wrote to memory of 1144	1660	Unicorn-36582.exe	45
PID 1660 wrote to memory of 1144	1660	Unicorn-36582.exe	45
PID 2940 wrote to memory of 2176	2940	Unicorn-2001.exe	46
PID 2940 wrote to memory of 2176	2940	Unicorn-2001.exe	46
PID 2940 wrote to memory of 2176	2940	Unicorn-2001.exe	46
PID 2940 wrote to memory of 2176	2940	Unicorn-2001.exe	46

C:\Users\Admin\AppData\Local\Temp\d40b6b81d537a9551d1aa4021c455c20N.exe
"C:\Users\Admin\AppData\Local\Temp\d40b6b81d537a9551d1aa4021c455c20N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30652.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46848.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        9⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
        10⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        9⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        9⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        9⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3926.exe
        8⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15954.exe
        9⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        9⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        9⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64518.exe
        8⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        8⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe
        7⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        7⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        7⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1861.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25650.exe
        8⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        8⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        8⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        7⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        7⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35283.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24674.exe
        6⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46219.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34354.exe
        6⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3216.exe
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34726.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        8⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        8⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        8⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5073.exe
        7⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
        6⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8794.exe
        7⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        7⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        6⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46786.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
        7⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48055.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        7⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        6⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1212.exe
        5⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4271.exe
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        7⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21572.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        6⤵
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19137.exe
        5⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        6⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40672.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27252.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
        6⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        7⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        7⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46106.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        6⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        5⤵
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
        6⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61787.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
        5⤵
        
        PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49213.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        7⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        7⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38840.exe
        6⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13957.exe
        5⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53910.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28258.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51446.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50323.exe
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8794.exe
        5⤵
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39886.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
      4⤵
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        5⤵
        
        PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15259.exe
      4⤵
      PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62317.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
      4⤵
      PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
      4⤵
      PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55903.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56630.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        7⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        9⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
        8⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21572.exe
        8⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        8⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26977.exe
        7⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2617.exe
        8⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15097.exe
        7⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
        6⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8239.exe
        7⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12420.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
        6⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        6⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
        6⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
        7⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        7⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2660.exe
        6⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        6⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28992.exe
        6⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 240
        7⤵
        Program crash
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21572.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39692.exe
        5⤵
        
        PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7734.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        6⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        6⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        5⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24475.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25798.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
        5⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
      4⤵
      PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
      4⤵
      PID:5124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7232.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        6⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39417.exe
        6⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58301.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        5⤵
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53667.exe
        5⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
        5⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      4⤵
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45108.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26783.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
      4⤵
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18807.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
      4⤵
      PID:6044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        5⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36567.exe
      4⤵
      PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exe
      4⤵
      PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26890.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
      4⤵
      PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
      4⤵
      PID:5864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62317.exe
    3⤵
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63185.exe
    3⤵
    PID:6104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50880.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exe
        5⤵
        Executes dropped EXE
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59998.exe
        6⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        7⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64113.exe
        6⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16919.exe
        5⤵
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28395.exe
        5⤵
        
        PID:280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46964.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64066.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52733.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14689.exe
        6⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55198.exe
        7⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        7⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1890.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
        6⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26229.exe
        5⤵
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        5⤵
        
        PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63131.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27115.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        6⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
        5⤵
        
        PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10303.exe
        5⤵
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
      4⤵
      PID:4828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe
        6⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        7⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29192.exe
        7⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exe
        5⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51247.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36654.exe
        6⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61123.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        5⤵
        
        PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21191.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25650.exe
        5⤵
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        5⤵
        
        PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65404.exe
      4⤵
      PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
      4⤵
      PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
        5⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65321.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57943.exe
      4⤵
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63888.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
        5⤵
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
      4⤵
      PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
      4⤵
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13726.exe
      4⤵
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
    3⤵
    PID:3000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
    3⤵
    PID:3268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46007.exe
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63185.exe
    3⤵
    PID:6096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52546.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19869.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36947.exe
        6⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        7⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2160.exe
        7⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        7⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        6⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        5⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        5⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        5⤵
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6691.exe
      4⤵
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
      4⤵
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
      4⤵
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
      4⤵
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        5⤵
        
        PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64081.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31054.exe
      4⤵
      PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10614.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12442.exe
      4⤵
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53719.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
      4⤵
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
      4⤵
      PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
    3⤵
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26802.exe
      4⤵
      PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
      4⤵
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
      4⤵
      PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51504.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
    3⤵
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51420.exe
    3⤵
    PID:4400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
    3⤵
    PID:5972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18395.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38286.exe
        5⤵
        
        PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        5⤵
        
        PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50901.exe
      4⤵
      PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
      4⤵
      PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
      4⤵
      PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
      4⤵
      PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
    3⤵
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
    3⤵
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
    3⤵
    PID:5276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38245.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38245.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
      4⤵
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
      4⤵
      PID:444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
      4⤵
      PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30677.exe
    3⤵
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64655.exe
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34397.exe
    3⤵
    PID:3076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
    3⤵
    PID:6024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15591.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15591.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
    3⤵
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54081.exe
      4⤵
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
    3⤵
    PID:4816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16699.exe
  2⤵
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63727.exe
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
    3⤵
    PID:4524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64165.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64165.exe
  2⤵
  PID:3456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
  2⤵
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26928.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26928.exe
  2⤵
  PID:356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-27252.exe

Filesize
468KB

MD5
ea90888695f7ccb54d4c218fb282047c

SHA1
d962415e12ee8e94ea05a545ed8a8f37d56eb51f

SHA256
f4559078dc483d3fe55eb3839ba14da743185eb2a0cf291eb86c38ed2e288a15

SHA512
c3e963f16199293be6cb7702a214cdb5b66e94239520b6bcb072b3f83d1c9b114197dee8727089d39b9348d7d88811dde837a08cb9414d313f2781b8c6c4cc91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30652.exe

Filesize
468KB

MD5
1632bdf52621078adcca037490d6111f

SHA1
ce1937704512ba6c9f0e39aebf6d635e3be15d29

SHA256
3cd9b090ec91f3da7e5ae84684c962811ecd88586db9b3f1911f36c51282ded1

SHA512
25d08891810e0eda15dd27925e74bfe38d18605a534b55efaa6d94da45a96182f061fa7ca2c93f348f4c78a650a8c8468b49dd0ed873f04ae6d4fd32011d8337

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe

Filesize
468KB

MD5
a58d2a337f0742d95173eb4077c7b890

SHA1
65979d1be65ac8ea0306d60126cef3bd11d9cce0

SHA256
c6dc8a499b0a974372d0668d30770342cca94f37c7ebb903fa92090ac5f4950d

SHA512
9ad8fa9b7585dae0e75ac5d762abd6b2ddace0a6d98f868f2df2d398b77a72115cc5ed080eec30f534cc07fd2223698512c6706966441012f33c0ffaeb0496e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe

Filesize
468KB

MD5
6c3dcac7b9f2798b8f6db8ea6288ea97

SHA1
29dc9b73eddecc72f0420f956621a1cb5077f6b0

SHA256
d3352916f8bb4e7553b8189029e6ede22362a6efa3a012d7873b0388a1c46871

SHA512
723bed81c9816bbc8ef8ab93878e50dcd9a06e84322b41842cb8070818283d50a46a9c85d4a19740b81833167ed19752956340c620209023a2d4e7fa354684f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe

Filesize
468KB

MD5
1062df693bdffda4cee8f8c5d19e96d7

SHA1
667b73f8619c875b115083bf932fb0643d08cd73

SHA256
6f2fd01fa2d714cb3e948d971a2edf2bb2d9e087bb57d0618c5caa6d6e6eae3a

SHA512
6ab98fe71a0471988712a237ea78ec82a3dd745b7427920c91db1eac1f33574c625498354bd272494ba9a336690d3a2f08ae6971b93e5b691bb52c689b502f61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe

Filesize
468KB

MD5
5645942d6b6f8c6273d2d7e2f220b5f7

SHA1
301199a2ae10a540a2510d45fa89b34d41cdbb94

SHA256
7067c823168fbc100c41b22dc04499be2d236924e34f27608902ddcbd65c28ef

SHA512
f06ef694e2e931e3b70f189422135818912a60d2672edea3a7a353cdfd0ef1b63fe368587d760b40b2b2880ac378a5f9c2de90dc175bc44e55a50eadebfe474b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52546.exe

Filesize
468KB

MD5
928b48fd60a77ae0c4df97ec4d982150

SHA1
0bd037747f8e78aac2175bab887b1e12d018542e

SHA256
26087b4a05a0cd5cc91129d413b9ab714f81c06a6135e14b54fcc663287303ce

SHA512
47cc7ec030876f614356632b3d53a27ebc655338b7a53c36141c2bc08d1b56cd4fdaa80def92cea3eb38db13c7d91a7e036877082bcf8cab639fb96b85726f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe

Filesize
468KB

MD5
67414b8853ec801b5eb9ab5b4a7b8f26

SHA1
779d66e6fcec50b6073cd8c306634540bde70671

SHA256
467d408712bdc608dcdfc1b70b845e3f5ef8a13ee72766cf45c41348edf73495

SHA512
688fcbb3d7591853ca93b3bcda156a9f480a5cf3c21e1374c53fb2b869ea4fb21ccf5955549b4bf2343bfa83ca75528f0f0fe45fe42d014532427939d526f4c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe

Filesize
468KB

MD5
f882e7ddc656946b8fbf486ab698adc7

SHA1
5739a92a1ed940501303f462e3a857c6cbe4f74c

SHA256
72fdcad7a77330f4a3786a47c91737914b13aecdedbd4b6c69f5f2b66362674d

SHA512
775276ac453acdf7ae9136b0ff006574f7924a083da354a41f96c0c8af09edc5a0d426ecc01d88cfb1cbaea7b0f245219615fe4f54e6bb051dd4c73cce09911e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe

Filesize
468KB

MD5
fe7ab6fda037fed68a6625346fd068fb

SHA1
358ad3c5665e8a225f5a9e44e304209c766d30f6

SHA256
964757bcb2b332e44507af777e22451c115d5acf36b8c6aa54142bfd3061c7e9

SHA512
e06c472f0017eaef5d0bb8a403e83d5e5455546bf320ea4e3897b8c322c021dc8490a6c2926b070aab33c7743ee856f47ccbe2c5c36ad762213a456a3cd19e92

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe

Filesize
468KB

MD5
57570e79aa23d94d74bcf299f3050364

SHA1
6ba0dfa1e94c9ab842666e3e1f51cc393e8eaa10

SHA256
8c38a229fc167a37b7d3f49a475572e35ea3caef3064396e88fdbae79f9d84bb

SHA512
1be7e6bc1ef804767c5b36eee953549b84e5d9ec51f4909c770728740c9fa546fec64daa82efdcbff4eb4106e025a3a8e1aea5e176f9bf018c9f93885a0c8bd7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27279.exe

Filesize
468KB

MD5
4177bfffdd7cbb7db848b9d3666a5643

SHA1
bc0178cf9fd2edb157733459db45d3f2d086e1e7

SHA256
7306e3678ebaf1351fc4e49ddadd3f939b514d24fb3966dde1f6f7c5aa2383ba

SHA512
3aee869e9030eac9acd9fe0c1e0345f936b1e39668e4bdb7c3fcb0370b3e1ebf39de6499cbce7beb9c512a5d2a24bcefae24e19199480c07062c20922f96a8a2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe

Filesize
468KB

MD5
af6a1e3e6ae940d55483e7117d457a0c

SHA1
b4e35db5fe4be7264b0ff83732972dd95f8ef243

SHA256
d5a84333bc08a0f1063b816379eb6fa75f052abd3c498bc1ba1bfc65c45b08e9

SHA512
c21fb9e8a0bea48a9a8c41e9716c4f1e8f656e59c743f92d9947982df92ee3b1573cfd40e26b2434a2210701fdac1937905b8f70d5fa2665308bc2b4656da563

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe

Filesize
468KB

MD5
d45a85bf59895f65b9706acbbb5ab6f4

SHA1
ac9d96127cf1c951fe2094ef564f70e53daffd50

SHA256
b73face0128efecc2f7bf4240e66cc838cbeba0916e018bdeb8155081e34ffe4

SHA512
c4874a4ee98b3b8e7241e1f1d28ba83942b3c4eb0b2f0d8ec9f2f01263dd2878b6d4704d9282aa93f178e8b7aa3bdbefc7c8b574c66dfa6349a71846a5b48699

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50880.exe

Filesize
468KB

MD5
1877bd548e4d10347df39936c14ce6e7

SHA1
ddace2687d00f83c3bd63f3255578d2ea28a41f2

SHA256
c663f52a36c11f7d20820c5b7775b29229dc67e840b97e1bd57d1847fe2db090

SHA512
271836c0f1578583d27a3feb706f123a9eba0d8bf03ad8d0f421a284659064b4d5595e58f4b3be6facb96f0cf25735d5fa974a80900b8bde4e08bf795f75d453

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe

Filesize
468KB

MD5
2ad9e161ee05b75f1f7db71fce75a691

SHA1
c91431848a7997d9c50ad636ca30f3473f2d85c8

SHA256
f0b7e5b9cc7a353f4c1f806cf1d43245a85ea986edf9fdac127162db9b5e0e37

SHA512
1db92e8d450e616e0e90abebd11480bcaaabf0e14a51bf9a66ff9d74159c5adcb53f58fe730a74e98e59d224ce6ea421eee667c9d4a2f563d38ebb59c12d24ba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe

Filesize
468KB

MD5
284b62eef93c639973e6d4939b1624be

SHA1
c5bcbad6d7c0b3c8b6a60303b0f36e7e7b515f0a

SHA256
a5ab1e88ddb5c28ee3ca64c8e56ee5a88623e8f36ac0b450ccb54d275b192a58

SHA512
00b630d6b93efd5f3d3c8d308566f34c02e23f17cab95e96bb970d91ca6ad4e183207527f5e352c54e5ccab7957ccc34f03d3270bd6f931a35861cb146c92e9c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55903.exe

Filesize
468KB

MD5
4e90e7015e168846220156091453b29b

SHA1
bd1e350e0b25513beee96ea31965335b13afb407

SHA256
2044d5536d86e850fab31e1933c76b21eb445963e9fef9c0e91794b2ea44753b

SHA512
845c4542777d0b8384382cc1fbe93ec559341f1b1b9f87a7a8b8d8eb3f874d8fc62a88a081daad421cc70e2282174422abf168ad73a05cd832c6ebbf527c33f7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56630.exe

Filesize
468KB

MD5
bf6c932a6b3a6ad2b740799763236feb

SHA1
971a73b5c056f7845c0ba7ad0859af33b1be4287

SHA256
21aa407b69f6d69d385f58b2078797972c05dbf1a5a3231a4bd50073550e1f8c

SHA512
84a838f17a9dd75791d9235715443ce77a0554b80e4f568d499fd71ee15bb564f5302b5e75bd95236463b3d3520607883d037e6a8a42aa591099e9673ca9c47f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe

Filesize
468KB

MD5
066fbfca92a4c3db66caaca4469ef769

SHA1
febc621f1d9c9562e7262a41796392d616f120ef

SHA256
0eecc85924141ad607c16589a496a9e632f215109f7ae34d8a43d8fb4a4982c7

SHA512
bf879bdd1b917bf3ff89670d9b88ee7cdfaf46ce1045fcde8237772e53baf2e540e534d3b56bc9d40504a350f328c7c457f5af3ee8a7420c9324e0c793b16fa4

Download Submit