e35b21aa4f930efb3f3d7b0a17071f6f124e5e8bc711fcd9ae9fd9613c22eb6b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4454f6281dcd1ac5f6a691d4b178fce0N.exe
Size

468KB
MD5

4454f6281dcd1ac5f6a691d4b178fce0
SHA1

35b639daf60ca1d14ea7970bf5981743605a4329
SHA256

e35b21aa4f930efb3f3d7b0a17071f6f124e5e8bc711fcd9ae9fd9613c22eb6b
SHA512

5af71ddbb32ab8ff4e006e2a6aab37dd07f2e7bc477394e2a0978806690c2d19da5a3dc4b14c0a6643c0dcedeefbe14bc5f96660bd8e38445be530c10532c102
SSDEEP

3072:aZ2CokqrhlJBtbYaPMP1Wf8/WChYpap1nlHCREhyx6XShY8gg1Ed:aZ7opjBt1PO1WftSWpx6iu8gg

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
804	Unicorn-10081.exe
2888	Unicorn-47113.exe
1456	Unicorn-21025.exe
2908	Unicorn-12349.exe
2660	Unicorn-19126.exe
2808	Unicorn-53282.exe
2552	Unicorn-28686.exe
2648	Unicorn-25754.exe
2980	Unicorn-22224.exe
1596	Unicorn-7834.exe
1688	Unicorn-23616.exe
1692	Unicorn-58161.exe
316	Unicorn-58426.exe
2316	Unicorn-48212.exe
2020	Unicorn-56563.exe
2820	Unicorn-1887.exe
2880	Unicorn-46257.exe
1064	Unicorn-31958.exe
3036	Unicorn-40803.exe
1632	Unicorn-20282.exe
2312	Unicorn-53055.exe
840	Unicorn-26967.exe
1436	Unicorn-46833.exe
1684	Unicorn-46833.exe
1672	Unicorn-12577.exe
2392	Unicorn-63169.exe
2168	Unicorn-54239.exe
1504	Unicorn-44430.exe
2008	Unicorn-12297.exe
2288	Unicorn-36802.exe
2328	Unicorn-39494.exe
2156	Unicorn-18328.exe
3028	Unicorn-63999.exe
1548	Unicorn-44705.exe
2076	Unicorn-34664.exe
1416	Unicorn-51000.exe
2724	Unicorn-44870.exe
2752	Unicorn-59168.exe
2564	Unicorn-49417.exe
2200	Unicorn-3480.exe
2616	Unicorn-3745.exe
2576	Unicorn-50900.exe
2524	Unicorn-51576.exe
2004	Unicorn-27626.exe
1080	Unicorn-48047.exe
640	Unicorn-59744.exe
1204	Unicorn-44592.exe
1656	Unicorn-18712.exe
2464	Unicorn-46530.exe
1736	Unicorn-30964.exe
3004	Unicorn-10443.exe
3000	Unicorn-62245.exe
860	Unicorn-16574.exe
2828	Unicorn-43770.exe
1452	Unicorn-33870.exe
924	Unicorn-34424.exe
1100	Unicorn-62458.exe
1556	Unicorn-17896.exe
1720	Unicorn-37762.exe
1228	Unicorn-37762.exe
1716	Unicorn-17241.exe
1612	Unicorn-3506.exe
916	Unicorn-43491.exe
1956	Unicorn-13319.exe

Loads dropped DLL 64 IoCs

pid	Process
776	4454f6281dcd1ac5f6a691d4b178fce0N.exe
776	4454f6281dcd1ac5f6a691d4b178fce0N.exe
804	Unicorn-10081.exe
804	Unicorn-10081.exe
776	4454f6281dcd1ac5f6a691d4b178fce0N.exe
776	4454f6281dcd1ac5f6a691d4b178fce0N.exe
2888	Unicorn-47113.exe
2888	Unicorn-47113.exe
804	Unicorn-10081.exe
804	Unicorn-10081.exe
776	4454f6281dcd1ac5f6a691d4b178fce0N.exe
776	4454f6281dcd1ac5f6a691d4b178fce0N.exe
1456	Unicorn-21025.exe
1456	Unicorn-21025.exe
2908	Unicorn-12349.exe
2908	Unicorn-12349.exe
2888	Unicorn-47113.exe
2888	Unicorn-47113.exe
1456	Unicorn-21025.exe
1456	Unicorn-21025.exe
2808	Unicorn-53282.exe
2808	Unicorn-53282.exe
2660	Unicorn-19126.exe
776	4454f6281dcd1ac5f6a691d4b178fce0N.exe
804	Unicorn-10081.exe
2660	Unicorn-19126.exe
804	Unicorn-10081.exe
776	4454f6281dcd1ac5f6a691d4b178fce0N.exe
2648	Unicorn-25754.exe
2648	Unicorn-25754.exe
2908	Unicorn-12349.exe
2908	Unicorn-12349.exe
2980	Unicorn-22224.exe
2980	Unicorn-22224.exe
2888	Unicorn-47113.exe
2888	Unicorn-47113.exe
1596	Unicorn-7834.exe
1596	Unicorn-7834.exe
1456	Unicorn-21025.exe
1456	Unicorn-21025.exe
1688	Unicorn-23616.exe
1688	Unicorn-23616.exe
2808	Unicorn-53282.exe
316	Unicorn-58426.exe
1692	Unicorn-58161.exe
2808	Unicorn-53282.exe
316	Unicorn-58426.exe
1692	Unicorn-58161.exe
2660	Unicorn-19126.exe
2660	Unicorn-19126.exe
2316	Unicorn-48212.exe
2316	Unicorn-48212.exe
776	4454f6281dcd1ac5f6a691d4b178fce0N.exe
776	4454f6281dcd1ac5f6a691d4b178fce0N.exe
804	Unicorn-10081.exe
804	Unicorn-10081.exe
2020	Unicorn-56563.exe
2020	Unicorn-56563.exe
2648	Unicorn-25754.exe
2880	Unicorn-46257.exe
2648	Unicorn-25754.exe
2880	Unicorn-46257.exe
1064	Unicorn-31958.exe
2980	Unicorn-22224.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2708	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4454f6281dcd1ac5f6a691d4b178fce0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4687.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
776	4454f6281dcd1ac5f6a691d4b178fce0N.exe
804	Unicorn-10081.exe
2888	Unicorn-47113.exe
1456	Unicorn-21025.exe
2908	Unicorn-12349.exe
2660	Unicorn-19126.exe
2552	Unicorn-28686.exe
2808	Unicorn-53282.exe
2648	Unicorn-25754.exe
2980	Unicorn-22224.exe
1596	Unicorn-7834.exe
1688	Unicorn-23616.exe
2316	Unicorn-48212.exe
316	Unicorn-58426.exe
1692	Unicorn-58161.exe
2020	Unicorn-56563.exe
2820	Unicorn-1887.exe
2880	Unicorn-46257.exe
1064	Unicorn-31958.exe
3036	Unicorn-40803.exe
1632	Unicorn-20282.exe
2312	Unicorn-53055.exe
840	Unicorn-26967.exe
1684	Unicorn-46833.exe
1436	Unicorn-46833.exe
1672	Unicorn-12577.exe
2392	Unicorn-63169.exe
2168	Unicorn-54239.exe
1504	Unicorn-44430.exe
2008	Unicorn-12297.exe
2288	Unicorn-36802.exe
2328	Unicorn-39494.exe
2156	Unicorn-18328.exe
3028	Unicorn-63999.exe
1548	Unicorn-44705.exe
2076	Unicorn-34664.exe
2724	Unicorn-44870.exe
1416	Unicorn-51000.exe
2752	Unicorn-59168.exe
2564	Unicorn-49417.exe
2200	Unicorn-3480.exe
2616	Unicorn-3745.exe
2524	Unicorn-51576.exe
2576	Unicorn-50900.exe
2004	Unicorn-27626.exe
1080	Unicorn-48047.exe
1204	Unicorn-44592.exe
640	Unicorn-59744.exe
1656	Unicorn-18712.exe
860	Unicorn-16574.exe
3004	Unicorn-10443.exe
2464	Unicorn-46530.exe
3000	Unicorn-62245.exe
1736	Unicorn-30964.exe
2828	Unicorn-43770.exe
1452	Unicorn-33870.exe
924	Unicorn-34424.exe
1228	Unicorn-37762.exe
1100	Unicorn-62458.exe
1720	Unicorn-37762.exe
1556	Unicorn-17896.exe
1716	Unicorn-17241.exe
1612	Unicorn-3506.exe
1956	Unicorn-13319.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 804	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	30
PID 776 wrote to memory of 804	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	30
PID 776 wrote to memory of 804	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	30
PID 776 wrote to memory of 804	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	30
PID 804 wrote to memory of 2888	804	Unicorn-10081.exe	32
PID 804 wrote to memory of 2888	804	Unicorn-10081.exe	32
PID 804 wrote to memory of 2888	804	Unicorn-10081.exe	32
PID 804 wrote to memory of 2888	804	Unicorn-10081.exe	32
PID 776 wrote to memory of 1456	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	33
PID 776 wrote to memory of 1456	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	33
PID 776 wrote to memory of 1456	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	33
PID 776 wrote to memory of 1456	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	33
PID 2888 wrote to memory of 2908	2888	Unicorn-47113.exe	34
PID 2888 wrote to memory of 2908	2888	Unicorn-47113.exe	34
PID 2888 wrote to memory of 2908	2888	Unicorn-47113.exe	34
PID 2888 wrote to memory of 2908	2888	Unicorn-47113.exe	34
PID 804 wrote to memory of 2660	804	Unicorn-10081.exe	35
PID 804 wrote to memory of 2660	804	Unicorn-10081.exe	35
PID 804 wrote to memory of 2660	804	Unicorn-10081.exe	35
PID 804 wrote to memory of 2660	804	Unicorn-10081.exe	35
PID 776 wrote to memory of 2808	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	36
PID 776 wrote to memory of 2808	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	36
PID 776 wrote to memory of 2808	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	36
PID 776 wrote to memory of 2808	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	36
PID 1456 wrote to memory of 2552	1456	Unicorn-21025.exe	37
PID 1456 wrote to memory of 2552	1456	Unicorn-21025.exe	37
PID 1456 wrote to memory of 2552	1456	Unicorn-21025.exe	37
PID 1456 wrote to memory of 2552	1456	Unicorn-21025.exe	37
PID 2908 wrote to memory of 2648	2908	Unicorn-12349.exe	38
PID 2908 wrote to memory of 2648	2908	Unicorn-12349.exe	38
PID 2908 wrote to memory of 2648	2908	Unicorn-12349.exe	38
PID 2908 wrote to memory of 2648	2908	Unicorn-12349.exe	38
PID 2888 wrote to memory of 2980	2888	Unicorn-47113.exe	39
PID 2888 wrote to memory of 2980	2888	Unicorn-47113.exe	39
PID 2888 wrote to memory of 2980	2888	Unicorn-47113.exe	39
PID 2888 wrote to memory of 2980	2888	Unicorn-47113.exe	39
PID 1456 wrote to memory of 1596	1456	Unicorn-21025.exe	40
PID 1456 wrote to memory of 1596	1456	Unicorn-21025.exe	40
PID 1456 wrote to memory of 1596	1456	Unicorn-21025.exe	40
PID 1456 wrote to memory of 1596	1456	Unicorn-21025.exe	40
PID 2808 wrote to memory of 1688	2808	Unicorn-53282.exe	41
PID 2808 wrote to memory of 1688	2808	Unicorn-53282.exe	41
PID 2808 wrote to memory of 1688	2808	Unicorn-53282.exe	41
PID 2808 wrote to memory of 1688	2808	Unicorn-53282.exe	41
PID 2660 wrote to memory of 316	2660	Unicorn-19126.exe	42
PID 2660 wrote to memory of 316	2660	Unicorn-19126.exe	42
PID 2660 wrote to memory of 316	2660	Unicorn-19126.exe	42
PID 2660 wrote to memory of 316	2660	Unicorn-19126.exe	42
PID 804 wrote to memory of 2316	804	Unicorn-10081.exe	44
PID 804 wrote to memory of 2316	804	Unicorn-10081.exe	44
PID 804 wrote to memory of 2316	804	Unicorn-10081.exe	44
PID 804 wrote to memory of 2316	804	Unicorn-10081.exe	44
PID 776 wrote to memory of 1692	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	43
PID 776 wrote to memory of 1692	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	43
PID 776 wrote to memory of 1692	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	43
PID 776 wrote to memory of 1692	776	4454f6281dcd1ac5f6a691d4b178fce0N.exe	43
PID 2648 wrote to memory of 2020	2648	Unicorn-25754.exe	45
PID 2648 wrote to memory of 2020	2648	Unicorn-25754.exe	45
PID 2648 wrote to memory of 2020	2648	Unicorn-25754.exe	45
PID 2648 wrote to memory of 2020	2648	Unicorn-25754.exe	45
PID 2908 wrote to memory of 2820	2908	Unicorn-12349.exe	46
PID 2908 wrote to memory of 2820	2908	Unicorn-12349.exe	46
PID 2908 wrote to memory of 2820	2908	Unicorn-12349.exe	46
PID 2908 wrote to memory of 2820	2908	Unicorn-12349.exe	46

C:\Users\Admin\AppData\Local\Temp\4454f6281dcd1ac5f6a691d4b178fce0N.exe
"C:\Users\Admin\AppData\Local\Temp\4454f6281dcd1ac5f6a691d4b178fce0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47113.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12349.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56563.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12297.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
        9⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
        9⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        9⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
        9⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        8⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        8⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        8⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        7⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        7⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        7⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        8⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        8⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        8⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        6⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        7⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44774.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        6⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
        7⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65066.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        8⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        7⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4817.exe
        7⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        7⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe
        6⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49581.exe
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
        7⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        6⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44870.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        6⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63151.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        7⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        6⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30099.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12883.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44774.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22224.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36802.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        8⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        8⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        8⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        7⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53579.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20098.exe
        6⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        6⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63999.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44682.exe
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17241.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33904.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14774.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        6⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16265.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        5⤵
        
        PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3945.exe
        7⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28017.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        7⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        6⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34239.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        6⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        5⤵
        
        PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        6⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        5⤵
        
        PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4218.exe
      4⤵
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58426.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46833.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25571.exe
        6⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        7⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47530.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        6⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7645.exe
        7⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        6⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58801.exe
        5⤵
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        5⤵
        
        PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        5⤵
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        5⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        6⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
        5⤵
        
        PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6085.exe
      4⤵
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        5⤵
        
        PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        5⤵
        
        PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61294.exe
      4⤵
      PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
      4⤵
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48212.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
        6⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        7⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11904.exe
        6⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15600.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18087.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        5⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46592.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        5⤵
        
        PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        5⤵
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        5⤵
        
        PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
      4⤵
      PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        5⤵
        
        PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
      4⤵
      PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44430.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59744.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22529.exe
        5⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40105.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47963.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
      4⤵
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
      4⤵
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59436.exe
        5⤵
        
        PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
      4⤵
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
      4⤵
      PID:4348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62600.exe
    3⤵
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38135.exe
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25786.exe
    3⤵
    PID:5344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21025.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21025.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7834.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51000.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
        6⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3945.exe
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61837.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
        6⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64658.exe
        5⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        5⤵
        
        PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        5⤵
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        5⤵
        
        PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
      4⤵
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
      4⤵
      PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
      4⤵
      PID:5316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        5⤵
        Executes dropped EXE
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18824.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        6⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60302.exe
        5⤵
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        5⤵
        
        PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
      4⤵
      PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
      4⤵
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35959.exe
      4⤵
      PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
      4⤵
      PID:5204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2332.exe
    3⤵
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1174.exe
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35901.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
    3⤵
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64489.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
      4⤵
      PID:5932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4808.exe
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53085.exe
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
    3⤵
    PID:2608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29101.exe
        6⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 220
        7⤵
        Program crash
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        6⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        6⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37823.exe
        5⤵
        
        PID:784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        6⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        6⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
        5⤵
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
      4⤵
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33686.exe
        5⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34318.exe
        5⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57624.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44652.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
      4⤵
      PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
      4⤵
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
        5⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15108.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        5⤵
        
        PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
      4⤵
      PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10443.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33904.exe
        5⤵
        
        PID:856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        6⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        6⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        5⤵
        
        PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
      4⤵
      PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
      4⤵
      PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9789.exe
        5⤵
        
        PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
      4⤵
      PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exe
    3⤵
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
      4⤵
      PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34364.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60937.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
    3⤵
    PID:5384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58161.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58161.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46833.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55743.exe
        5⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        6⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        5⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        5⤵
        
        PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
      4⤵
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3945.exe
        5⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13374.exe
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
        6⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56985.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        5⤵
        
        PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
      4⤵
      PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60407.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48047.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35959.exe
      4⤵
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
      4⤵
      PID:2612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
    3⤵
    PID:276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
      4⤵
      PID:5484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
    3⤵
    PID:288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61310.exe
    3⤵
    PID:3156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
    3⤵
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
    3⤵
    PID:5608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
      4⤵
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26669.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15123.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
      4⤵
      PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
    3⤵
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
    3⤵
    PID:3564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34894.exe
    3⤵
    PID:4712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46530.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46530.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
    3⤵
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
      4⤵
      PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
      4⤵
      PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14038.exe
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34262.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
    3⤵
    PID:5752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25613.exe
  2⤵
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
    3⤵
    PID:4064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
    3⤵
    PID:4708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
  2⤵
  PID:3136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34974.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34974.exe
  2⤵
  PID:3548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
  2⤵
  PID:4240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
  2⤵
  PID:5220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11904.exe

Filesize
468KB

MD5
ab6c6b5d5f7d8ff7d1df24033cf8c182

SHA1
cd89efc7ecb0c63e07063e49811a210386de58f0

SHA256
a7d7b133cc47d41dbc1232372a25726cd953fcb518491af230bfc214a8602a18

SHA512
e4971b1ddcf7de9a4e2876430e0a5175de3aa318bbbb777959c008aa349f278b53de8949bc39efb09a0e7426e81b8c0205b4f706c514dd44b7c52dc6b5bfde17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe

Filesize
468KB

MD5
92aebbe877e30481d7cdc859f72dd512

SHA1
517a9cee212e572de44978335a1c71aaf0dd89e1

SHA256
5e9c76282d0e6b40acf436f854737ae5bfdf588a15be8d53d22da99ca71c70cc

SHA512
ba296180c2aa1712cc7a3ccf97bdfb2c2b4b3fbd83c9d8c6dc5a0a94f248af2343c2179aa156d1f1912da53317d77dd80f72a20f2008549b805ead977b7c12a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe

Filesize
468KB

MD5
81a9f2552e7b9ef2d73ff0617e80b8c7

SHA1
2428ebd4fa7be5b86c2fe51642927a803092a768

SHA256
74f3f437f8e790dea93964ed42fa94ef1736b647b561012db25e391b32f73a0d

SHA512
65182bf09238d5a3e7bd31d037b117851528d7933ffd02458ad8b57a7dd183c1a161bcc3f000c9427a3ac97550a3c10ec51083493d407416fb234a5db2a31663

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47113.exe

Filesize
468KB

MD5
9a5102258051e2fc3cecad00c293b4fb

SHA1
608df423a32392ae51224f542f9a53d6d3efbc15

SHA256
9e3174108f8af3b5332cf12baac5dca3e3933966298d40fe4e01b0198cba98b8

SHA512
4bd5d697474254d6aade27fb24f836cbb45a3a07b200569df1cad6fdf4cb92d89e771adf97f36226dd3e7265fc15d99e7fbffae73c78f5e2a3d9af12d3813b94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9789.exe

Filesize
468KB

MD5
ee101afd9f7942ae3a71c66ac780b615

SHA1
d4caa6d47d7c4c87ee7e805532fab9d85568a8b1

SHA256
45779b59163dff57b9d139d48f957e3304a27195b37a68f8b61460b0963181e9

SHA512
9f90096cc5d6445c1b3b58cf3a81ca50c4a869aa0415165a81b2f3d31483e8e47bea0d4cbd4c65b80ca4e59987066e7a97b4e64be3dfd9ba337e366df134ae24

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe

Filesize
468KB

MD5
e4da792fbd18cbac465c122e5cde4f07

SHA1
5b383bc79dde04fc64fb50551c209bc5c2718005

SHA256
bf355227518725be97a4be51fee8f236e6ee14dca592510d326681a587b669e4

SHA512
53673f961a7bae514be1f27572f722cb5e73a33d2c6f4f5d2d205ddeaf36ba6a354ba1d85acd016e60fedbac401e91a012cef52cf770bf0f3944b1759253095c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12349.exe

Filesize
468KB

MD5
1be4e24c91c3c4375c6be8b088cf5511

SHA1
0cd16d257fbe17c5f661a5b56e6b9de4082c68b1

SHA256
c7610dbcf5ed7fd92bc7bb2b9400898975fc1ba09babc0639499e138d1e9b05e

SHA512
62b29d4f784961e1c440267318d5627f87ca1e5bd0ce594de75c35053d84cc028a717df962adbd646419b86809f94a1ec69c12cd658c22081b18306620b82656

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe

Filesize
468KB

MD5
b827bd7f7e2bd4aad4a60b9b9ab27026

SHA1
6ff7e5dc865671d09d0f3a71533b96cab67f133c

SHA256
d80792d73ef9fe007c0802df2d9d06a6202ab11e104bd9291b68c38311967775

SHA512
8bf7cc549ff179c8bd55efa406250d725bfda712c5d5676ea48ef61b0f7aa5d6b6e52bf9674a8aa4bf3d1033e039ba58a7361409886a45276e9d560a3c7e9885

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21025.exe

Filesize
468KB

MD5
19d5c0f6b27f680c9ef233f3267ad727

SHA1
4d7baf84eaa6e9e01651ac1157d578481bd95e14

SHA256
4746359a945a655f7564ee1b63ee2c425a952d1a158c1a4464cb0c6403918e3b

SHA512
98120876c6e2e124c632306ef86cb318fa8e37e6b704c9f1a2b7a3bf21eea8eb26f5439336821cf2ed9302a545a7504b0056c5067f42e64b23474d0a74fdef86

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22224.exe

Filesize
468KB

MD5
6fd0245270f9cda2109f8f64d2d90426

SHA1
1c0a9c5ff6fddb169658c0c0c57330f58d809493

SHA256
cdbb40203042ce5c3e4ae84db9a227887ed535fc572a448a4d12e28886c134bf

SHA512
f835088299e5eeff1f67b443d342192650581967d6717d361451849f5489baec8c4aafa6283994befc87676ab87798f562e565441b49ace6a340b76f38cc48bf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe

Filesize
468KB

MD5
2f742b8fd0263cf448351950e093a4bb

SHA1
3d61874f09e340065ad609b2448a12c434d2498d

SHA256
05b5dfe852bee389c807f6f176aae913fadb8df6ba3019e6564d36eca474f2cc

SHA512
d6c5414c3170706075f3285337578da137080e22784790fdd06b0e03635d85251317c161838c1c25215ecfad17f79a0a8965bf4e42a56232df1381472277bfa8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe

Filesize
468KB

MD5
1400886e1ed39443100796ae6c3e8f50

SHA1
195751f90bc90977e2cfa9203f2d03f2206792c2

SHA256
11435d13c7a497a6a54ee1176de416c4dcf9735da4c12c655846f28e2950c1d7

SHA512
dcdeb31c32ee113764ec62f1cf8403bf0da37bc74adddc1c2c914d93ba971c2e08f088c73610bd5dcf3eb1b916c49c988dd52b6795d8d3e6a6139cad7a485511

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe

Filesize
468KB

MD5
24143d3b2ab9e75d0353222cb8b46ad9

SHA1
321fecbec7db51f9c2a4c643f763927af92c8fcb

SHA256
b376f0f010ece33eabb2335bc19e208c00ef8e486b130f6846250445d19611f2

SHA512
fc6def78f1411a39a9806d6485eea934789a4cb195139fa15fba1a39790e206207fb2a38b99b5ffe38521a984210606015e3e9e2df4b262458d62ac9c8223e1f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe

Filesize
468KB

MD5
633d784c8ae4c5d7fe5374c591701acb

SHA1
5704c2736023115b5ac99b23fc848165c53e22d0

SHA256
e4103ea89454001473922146542590579f20f20bf7d6359f6e0ae33df6b758fd

SHA512
84ffafae55a91a7b0311cf0fd0f291f1998f6fc976f9333ded76cc23017b4d0f17307881259ead52925c051c715bb596d1992c6fde7eb97a5b97ffa49c1af4e3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe

Filesize
468KB

MD5
b54841e29b95b872b7a9b9b5f8d86bc4

SHA1
21e4173775d3bf5084cc5c41c4d041d1b5e157e5

SHA256
cdbf4728e7a2ada1073c4f2c0db8c594a2005225635ae8074b491345c2287da0

SHA512
83165d3fe500d41918b657f6fe0d3b2be6009a23dac426a63b97e88545a0147d42fd0b635dbeb704f2316e066a9425c4bc239c4ac964d96be7ff16331a43dc9f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48212.exe

Filesize
468KB

MD5
d3dc2782cfc4015eb637606e1beddf38

SHA1
ee54040472a0f33f1b6b0069efc501fba21a2bdd

SHA256
1093a06e37b7d60abb9a65bcb0351d872f1d941f83da3eba62ae230ab9bd0a72

SHA512
695ccf85942aa86d13422f401702519397cc455c57013d4cb4111c6ba239b40adabdb3e4b970b66b14f01dad8bca0e3a34ceef2824d79bc1a2b3b87980aec84c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe

Filesize
468KB

MD5
ba3a1bcbdeed449abbb031f7e103c417

SHA1
dab1d6d7d681d2a51eca73667e40bee3cc5bd06a

SHA256
dad94d8bbc20034eaffc5893e3563e7ed253778f8d0b41567857519774102905

SHA512
80ccbb9d6d99610b16604dc96b236962f75bc84576185025e6ce1f6e089579769b599e6864abc4931830e0323804aac09ba02180dc48684dbcdd8d3f7c846606

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56563.exe

Filesize
468KB

MD5
1b3335490d84689c51e11fd111293023

SHA1
0740d1c3f4c28399201506e8b82d994e91b6faeb

SHA256
f073a56731a1514e1d37138f5fff63c01bc5cdcdefba8046cee7f8454e91e8a2

SHA512
c652078761b46cec16bfeb3a7d67b1056bbd47053609e8976e04764652117cfd7b83f63393bfdf39c1c172fab2d9819a4a1738749b77c4a263b852a7a5feef84

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58161.exe

Filesize
468KB

MD5
f15bcb16636b24e327dbd4d50937f82c

SHA1
9723da710aa34dcba06b8b056182cd0d41f37dc0

SHA256
bf3fa0aca27c4a3aae4ec3798a59f3e7fde3f217615e7390f1abc0c4737799d4

SHA512
8e9a93ebb40452ebd48df738aff860061480ec98494e955462f9c81f51e8830cc3fdd134565ea180cfa807579f92e485f02da048c5db9560696911137a4a4766

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58426.exe

Filesize
468KB

MD5
e701e47365551afa7356eb251d5145a8

SHA1
d6f2040bbabdf7567e90d75001952a0fc132c1da

SHA256
70cffafdbf3215995d86097168b7eaeebfe93aa6017d11277214213ac1979297

SHA512
85a2fcbea32df2f6f4e7ac6b6e2dc5c0b2102a212da71aa2cd25b07fa25ba1a2a896cc4b7a510a599bd1225e227f31cba6abfa2f280d31501f75c74f74cca177

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7834.exe

Filesize
468KB

MD5
9f3c3ac89b0a5d7188ce28ea86ae3e40

SHA1
71664215c3465472c3d7200a5d2ecb827a78812c

SHA256
d97fe2ebf77926220f4cbf3162e925a36a7d21fbe8effe8aae89e7e7b3d518e5

SHA512
d9f16f9500299d02edc1d849d08657e504411349c2c96403c66bd06b85dc690de8e5ae2598c9ad083d85e5e1d5a650c301a034280c24341dae8ec629679dda4c

Download Submit