d775ad6e8bc46051b14d91f3fa3ce7f39a7c62c75775f23e354d0d46456219f7

Analysis

max time kernel
115s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

960578176da86ac95eaa6700b139aca0N.exe
Size

468KB
MD5

960578176da86ac95eaa6700b139aca0
SHA1

10c63f236f73e946d542ac1e4467d2a19401cb92
SHA256

d775ad6e8bc46051b14d91f3fa3ce7f39a7c62c75775f23e354d0d46456219f7
SHA512

1e6b605a1350f58d38081ef60cd5ac88b3ee1ce76cd9f43c66927a225f68ca5caa15909fcabf9904fb2aefeb77718e7ffb0bf4ffe350d12c23a8d5c4339edc26
SSDEEP

3072:1U0KodIKq85UXbYJHOcOcf8/XCusq0pBnLHewmZVFPV+lSRs64lF:1U5oiUUXOHnOcfkYU/FPc8Rs6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2352	Unicorn-44479.exe
2460	Unicorn-41355.exe
2348	Unicorn-44048.exe
2680	Unicorn-21018.exe
2780	Unicorn-23710.exe
2928	Unicorn-597.exe
2148	Unicorn-64088.exe
1688	Unicorn-19155.exe
2604	Unicorn-17571.exe
3008	Unicorn-25185.exe
2016	Unicorn-45697.exe
2600	Unicorn-31961.exe
1532	Unicorn-51827.exe
2044	Unicorn-31682.exe
1920	Unicorn-52943.exe
2732	Unicorn-6435.exe
2276	Unicorn-9149.exe
576	Unicorn-22793.exe
1864	Unicorn-60296.exe
1124	Unicorn-14624.exe
684	Unicorn-28252.exe
1376	Unicorn-6456.exe
1520	Unicorn-8080.exe
2240	Unicorn-63633.exe
744	Unicorn-2180.exe
300	Unicorn-20655.exe
656	Unicorn-24474.exe
532	Unicorn-5287.exe
292	Unicorn-63725.exe
984	Unicorn-24438.exe
888	Unicorn-47572.exe
2204	Unicorn-54349.exe
1608	Unicorn-59916.exe
1944	Unicorn-35320.exe
2052	Unicorn-21021.exe
2060	Unicorn-51464.exe
2644	Unicorn-23430.exe
2740	Unicorn-57686.exe
2244	Unicorn-61770.exe
2744	Unicorn-27944.exe
1440	Unicorn-57586.exe
2580	Unicorn-32990.exe
2548	Unicorn-9040.exe
1496	Unicorn-47956.exe
2628	Unicorn-47956.exe
2112	Unicorn-58262.exe
1176	Unicorn-57997.exe
1512	Unicorn-38396.exe
2092	Unicorn-64847.exe
1876	Unicorn-53986.exe
1204	Unicorn-53986.exe
1724	Unicorn-5532.exe
2620	Unicorn-25133.exe
1916	Unicorn-47764.exe
1768	Unicorn-17038.exe
2872	Unicorn-50457.exe
2228	Unicorn-4785.exe
2156	Unicorn-43580.exe
2080	Unicorn-63338.exe
904	Unicorn-31319.exe
2300	Unicorn-64738.exe
1332	Unicorn-25097.exe
1700	Unicorn-27789.exe
760	Unicorn-31127.exe

Loads dropped DLL 64 IoCs

pid	Process
2984	960578176da86ac95eaa6700b139aca0N.exe
2984	960578176da86ac95eaa6700b139aca0N.exe
2352	Unicorn-44479.exe
2352	Unicorn-44479.exe
2984	960578176da86ac95eaa6700b139aca0N.exe
2984	960578176da86ac95eaa6700b139aca0N.exe
2460	Unicorn-41355.exe
2460	Unicorn-41355.exe
2352	Unicorn-44479.exe
2352	Unicorn-44479.exe
2348	Unicorn-44048.exe
2348	Unicorn-44048.exe
2984	960578176da86ac95eaa6700b139aca0N.exe
2984	960578176da86ac95eaa6700b139aca0N.exe
2680	Unicorn-21018.exe
2680	Unicorn-21018.exe
2460	Unicorn-41355.exe
2460	Unicorn-41355.exe
2928	Unicorn-597.exe
2928	Unicorn-597.exe
2352	Unicorn-44479.exe
2348	Unicorn-44048.exe
2352	Unicorn-44479.exe
2780	Unicorn-23710.exe
2348	Unicorn-44048.exe
2780	Unicorn-23710.exe
2984	960578176da86ac95eaa6700b139aca0N.exe
2984	960578176da86ac95eaa6700b139aca0N.exe
1688	Unicorn-19155.exe
1688	Unicorn-19155.exe
2680	Unicorn-21018.exe
2680	Unicorn-21018.exe
2148	Unicorn-64088.exe
2148	Unicorn-64088.exe
1532	Unicorn-51827.exe
1532	Unicorn-51827.exe
2780	Unicorn-23710.exe
2780	Unicorn-23710.exe
2044	Unicorn-31682.exe
2044	Unicorn-31682.exe
2984	960578176da86ac95eaa6700b139aca0N.exe
2984	960578176da86ac95eaa6700b139aca0N.exe
3008	Unicorn-25185.exe
3008	Unicorn-25185.exe
2928	Unicorn-597.exe
2928	Unicorn-597.exe
2016	Unicorn-45697.exe
2016	Unicorn-45697.exe
2604	Unicorn-17571.exe
2600	Unicorn-31961.exe
2604	Unicorn-17571.exe
2600	Unicorn-31961.exe
2352	Unicorn-44479.exe
2352	Unicorn-44479.exe
2460	Unicorn-41355.exe
2460	Unicorn-41355.exe
2348	Unicorn-44048.exe
2348	Unicorn-44048.exe
1920	Unicorn-52943.exe
1920	Unicorn-52943.exe
2732	Unicorn-6435.exe
2732	Unicorn-6435.exe
1688	Unicorn-19155.exe
1688	Unicorn-19155.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51827.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2984	960578176da86ac95eaa6700b139aca0N.exe
2352	Unicorn-44479.exe
2460	Unicorn-41355.exe
2348	Unicorn-44048.exe
2680	Unicorn-21018.exe
2780	Unicorn-23710.exe
2928	Unicorn-597.exe
2148	Unicorn-64088.exe
1688	Unicorn-19155.exe
2604	Unicorn-17571.exe
2600	Unicorn-31961.exe
3008	Unicorn-25185.exe
1532	Unicorn-51827.exe
2016	Unicorn-45697.exe
2044	Unicorn-31682.exe
1920	Unicorn-52943.exe
2732	Unicorn-6435.exe
2276	Unicorn-9149.exe
576	Unicorn-22793.exe
1864	Unicorn-60296.exe
1124	Unicorn-14624.exe
684	Unicorn-28252.exe
1376	Unicorn-6456.exe
1520	Unicorn-8080.exe
2240	Unicorn-63633.exe
744	Unicorn-2180.exe
300	Unicorn-20655.exe
656	Unicorn-24474.exe
532	Unicorn-5287.exe
292	Unicorn-63725.exe
984	Unicorn-24438.exe
888	Unicorn-47572.exe
2204	Unicorn-54349.exe
1608	Unicorn-59916.exe
1944	Unicorn-35320.exe
2052	Unicorn-21021.exe
2060	Unicorn-51464.exe
2740	Unicorn-57686.exe
2644	Unicorn-23430.exe
2244	Unicorn-61770.exe
2744	Unicorn-27944.exe
1440	Unicorn-57586.exe
2580	Unicorn-32990.exe
1496	Unicorn-47956.exe
2548	Unicorn-9040.exe
2628	Unicorn-47956.exe
1176	Unicorn-57997.exe
1512	Unicorn-38396.exe
2112	Unicorn-58262.exe
1876	Unicorn-53986.exe
2092	Unicorn-64847.exe
1204	Unicorn-53986.exe
1724	Unicorn-5532.exe
2620	Unicorn-25133.exe
2872	Unicorn-50457.exe
1916	Unicorn-47764.exe
2156	Unicorn-43580.exe
1768	Unicorn-17038.exe
2228	Unicorn-4785.exe
2080	Unicorn-63338.exe
2300	Unicorn-64738.exe
904	Unicorn-31319.exe
1332	Unicorn-25097.exe
1700	Unicorn-27789.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2352	2984	960578176da86ac95eaa6700b139aca0N.exe	30
PID 2984 wrote to memory of 2352	2984	960578176da86ac95eaa6700b139aca0N.exe	30
PID 2984 wrote to memory of 2352	2984	960578176da86ac95eaa6700b139aca0N.exe	30
PID 2984 wrote to memory of 2352	2984	960578176da86ac95eaa6700b139aca0N.exe	30
PID 2352 wrote to memory of 2460	2352	Unicorn-44479.exe	32
PID 2352 wrote to memory of 2460	2352	Unicorn-44479.exe	32
PID 2352 wrote to memory of 2460	2352	Unicorn-44479.exe	32
PID 2352 wrote to memory of 2460	2352	Unicorn-44479.exe	32
PID 2984 wrote to memory of 2348	2984	960578176da86ac95eaa6700b139aca0N.exe	33
PID 2984 wrote to memory of 2348	2984	960578176da86ac95eaa6700b139aca0N.exe	33
PID 2984 wrote to memory of 2348	2984	960578176da86ac95eaa6700b139aca0N.exe	33
PID 2984 wrote to memory of 2348	2984	960578176da86ac95eaa6700b139aca0N.exe	33
PID 2460 wrote to memory of 2680	2460	Unicorn-41355.exe	34
PID 2460 wrote to memory of 2680	2460	Unicorn-41355.exe	34
PID 2460 wrote to memory of 2680	2460	Unicorn-41355.exe	34
PID 2460 wrote to memory of 2680	2460	Unicorn-41355.exe	34
PID 2352 wrote to memory of 2780	2352	Unicorn-44479.exe	35
PID 2352 wrote to memory of 2780	2352	Unicorn-44479.exe	35
PID 2352 wrote to memory of 2780	2352	Unicorn-44479.exe	35
PID 2352 wrote to memory of 2780	2352	Unicorn-44479.exe	35
PID 2348 wrote to memory of 2928	2348	Unicorn-44048.exe	36
PID 2348 wrote to memory of 2928	2348	Unicorn-44048.exe	36
PID 2348 wrote to memory of 2928	2348	Unicorn-44048.exe	36
PID 2348 wrote to memory of 2928	2348	Unicorn-44048.exe	36
PID 2984 wrote to memory of 2148	2984	960578176da86ac95eaa6700b139aca0N.exe	37
PID 2984 wrote to memory of 2148	2984	960578176da86ac95eaa6700b139aca0N.exe	37
PID 2984 wrote to memory of 2148	2984	960578176da86ac95eaa6700b139aca0N.exe	37
PID 2984 wrote to memory of 2148	2984	960578176da86ac95eaa6700b139aca0N.exe	37
PID 2680 wrote to memory of 1688	2680	Unicorn-21018.exe	38
PID 2680 wrote to memory of 1688	2680	Unicorn-21018.exe	38
PID 2680 wrote to memory of 1688	2680	Unicorn-21018.exe	38
PID 2680 wrote to memory of 1688	2680	Unicorn-21018.exe	38
PID 2460 wrote to memory of 2604	2460	Unicorn-41355.exe	39
PID 2460 wrote to memory of 2604	2460	Unicorn-41355.exe	39
PID 2460 wrote to memory of 2604	2460	Unicorn-41355.exe	39
PID 2460 wrote to memory of 2604	2460	Unicorn-41355.exe	39
PID 2928 wrote to memory of 3008	2928	Unicorn-597.exe	40
PID 2928 wrote to memory of 3008	2928	Unicorn-597.exe	40
PID 2928 wrote to memory of 3008	2928	Unicorn-597.exe	40
PID 2928 wrote to memory of 3008	2928	Unicorn-597.exe	40
PID 2352 wrote to memory of 2016	2352	Unicorn-44479.exe	41
PID 2352 wrote to memory of 2016	2352	Unicorn-44479.exe	41
PID 2352 wrote to memory of 2016	2352	Unicorn-44479.exe	41
PID 2352 wrote to memory of 2016	2352	Unicorn-44479.exe	41
PID 2348 wrote to memory of 2600	2348	Unicorn-44048.exe	42
PID 2348 wrote to memory of 2600	2348	Unicorn-44048.exe	42
PID 2348 wrote to memory of 2600	2348	Unicorn-44048.exe	42
PID 2348 wrote to memory of 2600	2348	Unicorn-44048.exe	42
PID 2780 wrote to memory of 1532	2780	Unicorn-23710.exe	43
PID 2780 wrote to memory of 1532	2780	Unicorn-23710.exe	43
PID 2780 wrote to memory of 1532	2780	Unicorn-23710.exe	43
PID 2780 wrote to memory of 1532	2780	Unicorn-23710.exe	43
PID 2984 wrote to memory of 2044	2984	960578176da86ac95eaa6700b139aca0N.exe	44
PID 2984 wrote to memory of 2044	2984	960578176da86ac95eaa6700b139aca0N.exe	44
PID 2984 wrote to memory of 2044	2984	960578176da86ac95eaa6700b139aca0N.exe	44
PID 2984 wrote to memory of 2044	2984	960578176da86ac95eaa6700b139aca0N.exe	44
PID 1688 wrote to memory of 1920	1688	Unicorn-19155.exe	45
PID 1688 wrote to memory of 1920	1688	Unicorn-19155.exe	45
PID 1688 wrote to memory of 1920	1688	Unicorn-19155.exe	45
PID 1688 wrote to memory of 1920	1688	Unicorn-19155.exe	45
PID 2680 wrote to memory of 2732	2680	Unicorn-21018.exe	46
PID 2680 wrote to memory of 2732	2680	Unicorn-21018.exe	46
PID 2680 wrote to memory of 2732	2680	Unicorn-21018.exe	46
PID 2680 wrote to memory of 2732	2680	Unicorn-21018.exe	46

C:\Users\Admin\AppData\Local\Temp\960578176da86ac95eaa6700b139aca0N.exe
"C:\Users\Admin\AppData\Local\Temp\960578176da86ac95eaa6700b139aca0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44479.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44479.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19155.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        9⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        9⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        9⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18189.exe
        8⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59296.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18465.exe
        8⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        9⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        9⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        9⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29739.exe
        7⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        8⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        8⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        7⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25097.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        8⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        8⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
        8⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        8⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-291.exe
        7⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56014.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5007.exe
        7⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        6⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28382.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27177.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36030.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27472.exe
        7⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        6⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37536.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        7⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        8⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        8⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-527.exe
        8⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20794.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46202.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24677.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56783.exe
        7⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27789.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16265.exe
        7⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36248.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6783.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        7⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34638.exe
        6⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        6⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exe
        6⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        7⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46202.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59488.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
        6⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        5⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
        5⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12955.exe
        5⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49543.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2180.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
        7⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
        8⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
        8⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        8⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3580.exe
        7⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21090.exe
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        7⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        6⤵
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21203.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50457.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        6⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38200.exe
        7⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        8⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        7⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
        7⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
        6⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32277.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        5⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40913.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        5⤵
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
        5⤵
        
        PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        5⤵
        
        PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5287.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18465.exe
        6⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
        7⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
        5⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44469.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44866.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24011.exe
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
        5⤵
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25133.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
        5⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46720.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3729.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        5⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        5⤵
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
      4⤵
      PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
      4⤵
      PID:6672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51827.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38333.exe
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
        6⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3823.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        7⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        6⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22648.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        7⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
        7⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
        6⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54592.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44815.exe
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32720.exe
        5⤵
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        5⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-877.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54453.exe
        6⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54949.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28365.exe
        5⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1551.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        5⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46202.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62996.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        5⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
        5⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6778.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17333.exe
        6⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41594.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
      4⤵
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18489.exe
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
      4⤵
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
      4⤵
      PID:7112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58262.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23063.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9012.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56482.exe
        6⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35594.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
        5⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        5⤵
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46202.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        5⤵
        
        PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6783.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
      4⤵
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
      4⤵
      PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35252.exe
      4⤵
      PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
        6⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        5⤵
        
        PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56014.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-347.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
      4⤵
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        5⤵
        
        PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
        5⤵
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
      4⤵
      PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
      4⤵
      PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
      4⤵
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10286.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
      4⤵
      PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27425.exe
    3⤵
    PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
      4⤵
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
      4⤵
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38108.exe
    3⤵
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
    3⤵
    PID:4380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
    3⤵
    PID:5700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
    3⤵
    PID:6996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6456.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32990.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe
        7⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60914.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        8⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19862.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
        8⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        7⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        7⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34587.exe
        6⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
        7⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49470.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17592.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
        6⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1551.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        7⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        6⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        5⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8049.exe
        6⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        6⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31980.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        5⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29870.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48881.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11557.exe
        5⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65142.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6124.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe
        5⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23063.exe
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        5⤵
        
        PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        5⤵
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
      4⤵
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
      4⤵
      PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22871.exe
        6⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        5⤵
        
        PID:296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61848.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
        5⤵
        
        PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe
        5⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
        6⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33455.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64801.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
      4⤵
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
        5⤵
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        5⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2968.exe
        5⤵
        
        PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exe
      4⤵
      PID:5848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54536.exe
        5⤵
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29342.exe
        6⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15697.exe
        6⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53721.exe
      4⤵
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        5⤵
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
      4⤵
      PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22008.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
      4⤵
      PID:6760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
      4⤵
      PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32277.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52652.exe
      4⤵
      PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17209.exe
    3⤵
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
      4⤵
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13690.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8157.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
      4⤵
      PID:6596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
    3⤵
    PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47714.exe
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
    3⤵
    PID:5356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
    3⤵
    PID:6956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35320.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
        5⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44047.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        5⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13207.exe
      4⤵
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        5⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        5⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23918.exe
        5⤵
        
        PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
      4⤵
      PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
      4⤵
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
      4⤵
      PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31127.exe
      4⤵
      Executes dropped EXE
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        5⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
      4⤵
      PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
      4⤵
      PID:608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
      4⤵
      PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44193.exe
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
      4⤵
      PID:6784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
    3⤵
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exe
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
      4⤵
      PID:6552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
    3⤵
    PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
    3⤵
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
    3⤵
    PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
    3⤵
    PID:7004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31682.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31682.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        5⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39671.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32277.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
      4⤵
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        5⤵
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-259.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20794.exe
        5⤵
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
      4⤵
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46202.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59488.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exe
      4⤵
      PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23430.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
      4⤵
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
      4⤵
      PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
      4⤵
      PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33343.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
      4⤵
      PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
    3⤵
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe
      4⤵
      PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
      4⤵
      PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
    3⤵
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
    3⤵
    PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20815.exe
    3⤵
    PID:6408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28252.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28252.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57686.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37733.exe
      4⤵
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
        5⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        5⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39679.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
      4⤵
      PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
    3⤵
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
      4⤵
      PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
      4⤵
      PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
    3⤵
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49348.exe
    3⤵
    PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
    3⤵
    PID:7072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27944.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27619.exe
    3⤵
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
      4⤵
      PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
      4⤵
      PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
    3⤵
    PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
    3⤵
    PID:6720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29333.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29333.exe
  2⤵
  PID:1972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
    3⤵
    PID:4756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
    3⤵
    PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49727.exe
    3⤵
    PID:6192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20794.exe
    3⤵
    PID:6976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
  2⤵
  PID:3564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
  2⤵
  PID:3356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
  2⤵
  PID:5752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
  2⤵
  PID:7040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-18189.exe

Filesize
468KB

MD5
4f12ab9a683ee7aa6f2f9ce4b80e19f3

SHA1
efe85e44ee0eb9ba5769e9b9ae74743dd83ea504

SHA256
644eb1ce7da010c4938b5bd7d95a2bd46f4c6f80a8bf044a4e49b6d6dcfdeda5

SHA512
e26c3912182fd605df6935245f3c670dc05682560949f0f4557ba7e75bcce889445722b3599963131a722654a6e2ed68a0b4cf41049133e9dfc549a3bb136a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe

Filesize
468KB

MD5
a355e8769893ae35d92438e62921ec60

SHA1
4dcafe298f0f3ee9a0a1f4af4872744fb56e7a19

SHA256
8d213109006968f3af6c6a113d06e225f1f39ebae1e2d5130258b5c8ed9e9965

SHA512
7b8ebc8a165543f1b3b5370460bc58b5f4c4bb63c937ec64ad35767debe4a6d2e29ea2e20bb0be9c177af971286f6ccf05054e65771d97ad8272fefab18b6e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe

Filesize
468KB

MD5
51469fb8299e06174b24cff624873365

SHA1
2e3476dcb03c48af5e7d7c0302de1a92cf383c77

SHA256
a29fcd94a9ab27f541b7dbc7e9cc759b44c4dd840883cfc360d52f8df6632be5

SHA512
b7692e02800f4a74d7da70afddaf809c866ce2da9befd595210cf42719092bd962d0828bf12df90c42fa64f11f8b9d4f34296c265fdf7074f91ed7b14d5a5be4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe

Filesize
468KB

MD5
3ce78040edc14ece32e457d2e6b80f66

SHA1
6bbf4567a05f13d526b6a9e71c31cbba808718e8

SHA256
2667fbc8e38c5456c256ffed8f5316330cfad00ce69a74c1ed326df8cd8d155b

SHA512
cd91aa419a05f0538d4a522094ebad860f9ddbe6d9fed125ed0c5b1cd032a15d261084f0ea1d0e81c9c5a8058c64394640335833531268d09a45c73a637d4d0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51827.exe

Filesize
468KB

MD5
57ca166f93840482d4a0ffe01d999e72

SHA1
820d82f73afcd153c91a1da0e9d770a813c2d8a5

SHA256
3cd5a69491a5936932007386bdfce3f23ac3f8c3307087697f3e95b6912b8050

SHA512
3db06f9e0ad45c516c93c5b4cc5af2dd5566bc88c1b262cbf68e0dbc531f33918653e7532ead6ba06b55d5deb47020becb84acf58d5a5fb4b0a88a0efba24641

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe

Filesize
468KB

MD5
6bbe237087d604166175ec542089d6c1

SHA1
d5ab10715f002df30ae4849a2c2eab49f955c974

SHA256
0716d528b04ca91bb5d41926bb36805f9e1895c9a4e98d0ae5c7449968e911a9

SHA512
5cbb719ee6c02e747f5ec1f3649778143dd43bf5b54efa92f19a2c654c54db2682669f0706d4444aa4b0314b5bd6af3a250d747d398b6d7411414da77f5d8545

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19155.exe

Filesize
468KB

MD5
fcec51ba5bb2453d47e81ec6539b1815

SHA1
bf0efeb6ec583d0429b213d531c1670f9cc3bfb1

SHA256
603831817569580ec24ca8b65b9ed6dc1d9b6cfc9941e0debdf6a48d7cf51c0f

SHA512
01cdeeb69953fa6fe2a03f76b2725103a4a20124b035b9d432d45971efb947cc0634385b5b3bc7956c292d3392a787864317c5e32cf53dd4356367fc863656bb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe

Filesize
468KB

MD5
bc83a5cfb3acc7abca09e681c1762750

SHA1
e3221413ce8b6bde2d2456664480b51e1842f018

SHA256
ccef2bee129e434bb2ec6aab1e2ad5786022746150c34aa49eed12ea72d1d6bd

SHA512
00de3c60c71b9fab022129aaabbb1c964b27125956acc79644c63304540513872951e0d0c05dfab79ab6969c6d1efa5c89abcb5e8abc1552f341e58d51026c3b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe

Filesize
468KB

MD5
2f6754ee802f5ef3ccfcae86e9053781

SHA1
8540a47ae2d5babcd5c514951c3b12025080b18e

SHA256
9876683f3f79e6007c6964518dcab0495edfcc28aa377434969980cfbd48624c

SHA512
eae9cb34c060d7f01ce9b27d160c89ecf175d3c146d9a6e8c85701c3a0334fc5651156660b89eb73250d0d47336cb08516df4f5c062d9e574f4419d6fa592f42

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe

Filesize
468KB

MD5
7363113aabfe50360214c254335fc209

SHA1
2b5988bf48e7424a3172502df2220b2328d6bec5

SHA256
33c6030f68a3b7e3ac3d3726eae1263e0b43d0a218a0ac8c88ea693d80d87d5f

SHA512
bd7cf6682af6aac11df333e05675732c2d951d3e65a594c3e0592f1d15b34b79c5c9dd6015b108f4ab66e274a78bf2a83612a814e3a6c139b17e40a4bc20ed15

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe

Filesize
468KB

MD5
dc31689313284323f9e47885b842f829

SHA1
fc05b6172ac135c19339e60222d6e4dd01eb6205

SHA256
cad115d4d2409599be2fda93346b95e2e64b4f8606ca95f0a28f770cc35924ff

SHA512
1f58c767a5c5661480f6694fdab9f7a218bb08f60c82317d7353a5f79483ade2189dacb9f8e46734670b5b5bf7d938c7fbaaeb6b78c5fca04462ea5dc7090739

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31682.exe

Filesize
468KB

MD5
4caebc80a7663158344e647265df2316

SHA1
af5898f89c2fb0c96fd4c51ffe605f8c02942b43

SHA256
6c5db035eb17e050710aa59fe92db7f5f72dc87164dc95190e1dc8c5e5e11bf3

SHA512
e37041a269eeedb790592e61f9d2bd12ff6e108d664faecf85619c2f9db2cbe9d185df9a1a067798b9dadc8ea2439cf3f191f71d1bf74cc0c9c845798436588c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe

Filesize
468KB

MD5
270334d349c4adb00306a0221a7b83f5

SHA1
1ea35edb0a2b5f9c8fe518c637bd22f36dd2a088

SHA256
0adc36abc47fbb2aec6a2cdb455b96e8bce2f9bd3d8bd6f9c333aae35cf7c8fa

SHA512
7bd5bc8a2db34f8cf5f9e03be77d70af652e53e6a0bc9b7f91d2aaa7e7e084c3597ce43e177480a0cc17f2eac6b0b12e786ffb992752f084a0fc1d749e115177

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe

Filesize
468KB

MD5
5fd915d134203fe4b91216b18e4891e0

SHA1
46198904744a92653114edc0fdd44f2cbcd42b1f

SHA256
f90df32aba9fc5123974a4641ac35ca728722682073a25e1704e27ac3b77dbd8

SHA512
87b31e14dc1ada979d66ed4db3df9d8ea8404d3e3bf82be4a3c4d679406379a25f59319f4622ee44b8a6ab73b5dcaf63b0038eaaf085132f8a50b720bdc92de6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44479.exe

Filesize
468KB

MD5
e4efb49661b649d30fa5fb2e7fa39b90

SHA1
1cf75c7ea02257fd783af582df73b3a5f8a9266f

SHA256
1a1c9be394e7b06ff3c3e8d8aecbcfedd9474474058477b42cea073d0836ae1a

SHA512
f26b8c7c6d233a4f188484ca751d0cbe496b8af52ace8ceaa13f69fd8ae0cd8e1c15cc0b11f07142d8601a6229105678b137f21cdcc3e289fce1b5f7982b4ecb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe

Filesize
468KB

MD5
a7f7f871e664bc32a1e3004402fca03f

SHA1
079270ef06173517a764e212e0185ed733d0fbf8

SHA256
d878f9b5a6bf47e47f90583b278a722635187f8bc134e33390c650f842a36935

SHA512
55b8a5cdb4364c0e68686c07b5073ca7157095c9906b0bbc90784181b7c10db10cc8fb761541cf8f98837a54da295c8c26846a826cc1f21450e844700072daa6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe

Filesize
468KB

MD5
cc67968fe4bdf69744611a3afd1e3068

SHA1
d46ed9287f55d6f81d7fa08c96ece6ebb3e2f774

SHA256
8b500c04dfeaefbd8907cae3b8b8cbcaaf7289e81a34f919cfc5433ec745c68c

SHA512
5eb8b6f02b46ec89afa240d9ba9740a4b959f4cd8e4a231c92358252cd970f83eb6beafd39c44b2d2860d99d44ce389942435515093c441f914875c4c0d2c0f2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-597.exe

Filesize
468KB

MD5
e0322154500d6058d9dd72a42a0ac7bf

SHA1
9d947022c7d633ff0fd2d892c14be9368c5be842

SHA256
ceb15991c99af026a5641271a415b6b06d3f2b8e342603ff2a4c60680b28cef9

SHA512
7a7ff5a46ac7dab8cb69d37cdcd19c91ea91b93281442a205f64a334cda33768589b2e668a02c14d2d327778d7cc71fe101c141eb1aa1cdb6c62e5851a969d9b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe

Filesize
468KB

MD5
5abd1bc01650ab035a2e1dcb1a8f1588

SHA1
0d86ccb8d74a0631b19cc939f4fe1c2c10b247dc

SHA256
95c08ca65f93126c31056ba105e40037e69609818129484f5aefb101a9b4ec9b

SHA512
f0e68beb83f81673cde37d60d5fcf2b5fa2ac81d98d32219937c0f40e8fc04e77b5037f474ad4fbdb6c8479f1533f7a14e83b2abfe953cd7a0f378fb35f6ad4f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe

Filesize
468KB

MD5
bcdb1ee7ba7bd66e080912b2f145a7a6

SHA1
06b08aa0a98cd9d152e50cc6e223c822734ceea1

SHA256
8779985f768376da64491891483e897aaf9dd10ca4bd834eefb512e4eef0598d

SHA512
43dfa09851913674bdd97b13aaf890f451f8e693296020a16dacbcbb6a96ddaa4263279a1a5c079f015c880a64019c03ec11342cdeaa828f7ac296a4007cd4d2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe

Filesize
468KB

MD5
86ee6b57ae85640c70c5b50e91b82244

SHA1
cdc545028b7e135ab992a961994b67211772e38c

SHA256
3fde1a229667bcb53a1b8fb96d196d3edf5290badbcd869e5ab0a48462440e40

SHA512
6837e297fce5d7efc26498a458efccf438c1cac297327ad03eea81445aa9b5b4d1b26a8c973ecabd09082dce251e30f5ad7ae2f7ee3e714d0e02fb90828d7138

Download Submit