005a2c38f5972176fc41ccb87e11740e7b5ca698a835788b89cf06c1e9916a43

Analysis

max time kernel
120s
max time network
21s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11c736a5567ba6f4cabac656fb7e8810N.exe
Size

468KB
MD5

11c736a5567ba6f4cabac656fb7e8810
SHA1

df43dcd39139331542e7c4b242cc28de75cc2716
SHA256

005a2c38f5972176fc41ccb87e11740e7b5ca698a835788b89cf06c1e9916a43
SHA512

8aeb83b6c1651f475fff4fe9c9c05446d929865121fbc2237cf86e2374164a490a1e51b83f5ae8068cb3193f1ea8bc41a6c48c3cbd4298a10680845f9720f509
SSDEEP

3072:pbqCogI7I55YBbYJPz9bff8SymXC6IpCnmHCxVhtvDLLSjmucUl7:pbXo6PYBOPpbffz0c/vDPkmuc

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2060	Unicorn-45706.exe
2864	Unicorn-50511.exe
2300	Unicorn-755.exe
2796	Unicorn-36417.exe
2980	Unicorn-40501.exe
2884	Unicorn-5590.exe
840	Unicorn-61476.exe
2624	Unicorn-35862.exe
2276	Unicorn-11720.exe
2152	Unicorn-31586.exe
1956	Unicorn-61061.exe
1572	Unicorn-61326.exe
972	Unicorn-61326.exe
1992	Unicorn-34775.exe
2128	Unicorn-21040.exe
3060	Unicorn-39043.exe
2044	Unicorn-36665.exe
1816	Unicorn-57600.exe
1840	Unicorn-39218.exe
3008	Unicorn-24352.exe
1400	Unicorn-24352.exe
1080	Unicorn-7750.exe
1324	Unicorn-57771.exe
1160	Unicorn-52940.exe
1228	Unicorn-27673.exe
536	Unicorn-36604.exe
1084	Unicorn-20460.exe
872	Unicorn-594.exe
2028	Unicorn-28628.exe
688	Unicorn-62047.exe
1480	Unicorn-55170.exe
1656	Unicorn-28073.exe
2260	Unicorn-4123.exe
2368	Unicorn-7460.exe
2352	Unicorn-46447.exe
2144	Unicorn-27689.exe
2112	Unicorn-52748.exe
1928	Unicorn-15629.exe
2988	Unicorn-55707.exe
2752	Unicorn-64637.exe
2848	Unicorn-52385.exe
2824	Unicorn-45732.exe
2880	Unicorn-59467.exe
1724	Unicorn-33117.exe
2592	Unicorn-33117.exe
2664	Unicorn-14734.exe
2656	Unicorn-4336.exe
2256	Unicorn-50008.exe
2660	Unicorn-57621.exe
1192	Unicorn-28649.exe
1628	Unicorn-8783.exe
2408	Unicorn-28384.exe
2488	Unicorn-28649.exe
1680	Unicorn-21092.exe
3052	Unicorn-47023.exe
2068	Unicorn-41861.exe
2148	Unicorn-41861.exe
2228	Unicorn-936.exe
272	Unicorn-27340.exe
868	Unicorn-47206.exe
1608	Unicorn-47206.exe
1740	Unicorn-64097.exe
1912	Unicorn-43676.exe
2364	Unicorn-31446.exe

Loads dropped DLL 64 IoCs

pid	Process
1488	11c736a5567ba6f4cabac656fb7e8810N.exe
1488	11c736a5567ba6f4cabac656fb7e8810N.exe
2060	Unicorn-45706.exe
1488	11c736a5567ba6f4cabac656fb7e8810N.exe
2060	Unicorn-45706.exe
1488	11c736a5567ba6f4cabac656fb7e8810N.exe
2864	Unicorn-50511.exe
2864	Unicorn-50511.exe
2300	Unicorn-755.exe
2300	Unicorn-755.exe
1488	11c736a5567ba6f4cabac656fb7e8810N.exe
1488	11c736a5567ba6f4cabac656fb7e8810N.exe
2060	Unicorn-45706.exe
2060	Unicorn-45706.exe
2796	Unicorn-36417.exe
2796	Unicorn-36417.exe
2864	Unicorn-50511.exe
2884	Unicorn-5590.exe
2864	Unicorn-50511.exe
2884	Unicorn-5590.exe
1488	11c736a5567ba6f4cabac656fb7e8810N.exe
840	Unicorn-61476.exe
1488	11c736a5567ba6f4cabac656fb7e8810N.exe
840	Unicorn-61476.exe
2980	Unicorn-40501.exe
2980	Unicorn-40501.exe
2300	Unicorn-755.exe
2060	Unicorn-45706.exe
2300	Unicorn-755.exe
2060	Unicorn-45706.exe
2624	Unicorn-35862.exe
2624	Unicorn-35862.exe
2796	Unicorn-36417.exe
2796	Unicorn-36417.exe
2276	Unicorn-11720.exe
2276	Unicorn-11720.exe
2864	Unicorn-50511.exe
2864	Unicorn-50511.exe
1992	Unicorn-34775.exe
1992	Unicorn-34775.exe
2152	Unicorn-31586.exe
2152	Unicorn-31586.exe
2060	Unicorn-45706.exe
2060	Unicorn-45706.exe
2884	Unicorn-5590.exe
2884	Unicorn-5590.exe
1956	Unicorn-61061.exe
1956	Unicorn-61061.exe
1488	11c736a5567ba6f4cabac656fb7e8810N.exe
1488	11c736a5567ba6f4cabac656fb7e8810N.exe
1572	Unicorn-61326.exe
1572	Unicorn-61326.exe
972	Unicorn-61326.exe
972	Unicorn-61326.exe
2980	Unicorn-40501.exe
2980	Unicorn-40501.exe
2128	Unicorn-21040.exe
2128	Unicorn-21040.exe
840	Unicorn-61476.exe
840	Unicorn-61476.exe
2300	Unicorn-755.exe
2300	Unicorn-755.exe
3060	Unicorn-39043.exe
3060	Unicorn-39043.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2412	2488	WerFault.exe	83
1716	1192	WerFault.exe	82
3656	2940	WerFault.exe	121

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27634.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1488	11c736a5567ba6f4cabac656fb7e8810N.exe
2060	Unicorn-45706.exe
2864	Unicorn-50511.exe
2300	Unicorn-755.exe
2796	Unicorn-36417.exe
2980	Unicorn-40501.exe
2884	Unicorn-5590.exe
840	Unicorn-61476.exe
2624	Unicorn-35862.exe
2276	Unicorn-11720.exe
1956	Unicorn-61061.exe
1572	Unicorn-61326.exe
1992	Unicorn-34775.exe
2128	Unicorn-21040.exe
2152	Unicorn-31586.exe
972	Unicorn-61326.exe
3060	Unicorn-39043.exe
2044	Unicorn-36665.exe
1816	Unicorn-57600.exe
1840	Unicorn-39218.exe
3008	Unicorn-24352.exe
1400	Unicorn-24352.exe
1080	Unicorn-7750.exe
1324	Unicorn-57771.exe
1160	Unicorn-52940.exe
1228	Unicorn-27673.exe
536	Unicorn-36604.exe
1084	Unicorn-20460.exe
872	Unicorn-594.exe
2028	Unicorn-28628.exe
1480	Unicorn-55170.exe
688	Unicorn-62047.exe
1656	Unicorn-28073.exe
2260	Unicorn-4123.exe
2368	Unicorn-7460.exe
2352	Unicorn-46447.exe
2144	Unicorn-27689.exe
2112	Unicorn-52748.exe
1928	Unicorn-15629.exe
2988	Unicorn-55707.exe
2752	Unicorn-64637.exe
2848	Unicorn-52385.exe
2824	Unicorn-45732.exe
2880	Unicorn-59467.exe
2592	Unicorn-33117.exe
2664	Unicorn-14734.exe
2256	Unicorn-50008.exe
2656	Unicorn-4336.exe
2660	Unicorn-57621.exe
1628	Unicorn-8783.exe
2488	Unicorn-28649.exe
2408	Unicorn-28384.exe
1192	Unicorn-28649.exe
2148	Unicorn-41861.exe
3052	Unicorn-47023.exe
2068	Unicorn-41861.exe
1680	Unicorn-21092.exe
868	Unicorn-47206.exe
272	Unicorn-27340.exe
2228	Unicorn-936.exe
1608	Unicorn-47206.exe
1740	Unicorn-64097.exe
1912	Unicorn-43676.exe
2364	Unicorn-31446.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2060	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	31
PID 1488 wrote to memory of 2060	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	31
PID 1488 wrote to memory of 2060	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	31
PID 1488 wrote to memory of 2060	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	31
PID 2060 wrote to memory of 2300	2060	Unicorn-45706.exe	32
PID 2060 wrote to memory of 2300	2060	Unicorn-45706.exe	32
PID 2060 wrote to memory of 2300	2060	Unicorn-45706.exe	32
PID 2060 wrote to memory of 2300	2060	Unicorn-45706.exe	32
PID 1488 wrote to memory of 2864	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	33
PID 1488 wrote to memory of 2864	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	33
PID 1488 wrote to memory of 2864	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	33
PID 1488 wrote to memory of 2864	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	33
PID 2864 wrote to memory of 2796	2864	Unicorn-50511.exe	34
PID 2864 wrote to memory of 2796	2864	Unicorn-50511.exe	34
PID 2864 wrote to memory of 2796	2864	Unicorn-50511.exe	34
PID 2864 wrote to memory of 2796	2864	Unicorn-50511.exe	34
PID 2300 wrote to memory of 2980	2300	Unicorn-755.exe	35
PID 2300 wrote to memory of 2980	2300	Unicorn-755.exe	35
PID 2300 wrote to memory of 2980	2300	Unicorn-755.exe	35
PID 2300 wrote to memory of 2980	2300	Unicorn-755.exe	35
PID 1488 wrote to memory of 2884	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	36
PID 1488 wrote to memory of 2884	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	36
PID 1488 wrote to memory of 2884	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	36
PID 1488 wrote to memory of 2884	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	36
PID 2060 wrote to memory of 840	2060	Unicorn-45706.exe	37
PID 2060 wrote to memory of 840	2060	Unicorn-45706.exe	37
PID 2060 wrote to memory of 840	2060	Unicorn-45706.exe	37
PID 2060 wrote to memory of 840	2060	Unicorn-45706.exe	37
PID 2796 wrote to memory of 2624	2796	Unicorn-36417.exe	38
PID 2796 wrote to memory of 2624	2796	Unicorn-36417.exe	38
PID 2796 wrote to memory of 2624	2796	Unicorn-36417.exe	38
PID 2796 wrote to memory of 2624	2796	Unicorn-36417.exe	38
PID 2864 wrote to memory of 2276	2864	Unicorn-50511.exe	39
PID 2864 wrote to memory of 2276	2864	Unicorn-50511.exe	39
PID 2864 wrote to memory of 2276	2864	Unicorn-50511.exe	39
PID 2864 wrote to memory of 2276	2864	Unicorn-50511.exe	39
PID 2884 wrote to memory of 2152	2884	Unicorn-5590.exe	40
PID 2884 wrote to memory of 2152	2884	Unicorn-5590.exe	40
PID 2884 wrote to memory of 2152	2884	Unicorn-5590.exe	40
PID 2884 wrote to memory of 2152	2884	Unicorn-5590.exe	40
PID 1488 wrote to memory of 1956	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	41
PID 1488 wrote to memory of 1956	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	41
PID 1488 wrote to memory of 1956	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	41
PID 1488 wrote to memory of 1956	1488	11c736a5567ba6f4cabac656fb7e8810N.exe	41
PID 840 wrote to memory of 972	840	Unicorn-61476.exe	42
PID 840 wrote to memory of 972	840	Unicorn-61476.exe	42
PID 840 wrote to memory of 972	840	Unicorn-61476.exe	42
PID 840 wrote to memory of 972	840	Unicorn-61476.exe	42
PID 2980 wrote to memory of 1572	2980	Unicorn-40501.exe	43
PID 2980 wrote to memory of 1572	2980	Unicorn-40501.exe	43
PID 2980 wrote to memory of 1572	2980	Unicorn-40501.exe	43
PID 2980 wrote to memory of 1572	2980	Unicorn-40501.exe	43
PID 2060 wrote to memory of 1992	2060	Unicorn-45706.exe	45
PID 2060 wrote to memory of 1992	2060	Unicorn-45706.exe	45
PID 2060 wrote to memory of 1992	2060	Unicorn-45706.exe	45
PID 2060 wrote to memory of 1992	2060	Unicorn-45706.exe	45
PID 2300 wrote to memory of 2128	2300	Unicorn-755.exe	44
PID 2300 wrote to memory of 2128	2300	Unicorn-755.exe	44
PID 2300 wrote to memory of 2128	2300	Unicorn-755.exe	44
PID 2300 wrote to memory of 2128	2300	Unicorn-755.exe	44
PID 2624 wrote to memory of 3060	2624	Unicorn-35862.exe	46
PID 2624 wrote to memory of 3060	2624	Unicorn-35862.exe	46
PID 2624 wrote to memory of 3060	2624	Unicorn-35862.exe	46
PID 2624 wrote to memory of 3060	2624	Unicorn-35862.exe	46

C:\Users\Admin\AppData\Local\Temp\11c736a5567ba6f4cabac656fb7e8810N.exe
"C:\Users\Admin\AppData\Local\Temp\11c736a5567ba6f4cabac656fb7e8810N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45706.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45706.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-755.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36604.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        8⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        8⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        8⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        7⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
        8⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        8⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17907.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        8⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        8⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14232.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4596.exe
        8⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        8⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35066.exe
        7⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
        7⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        7⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-594.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28649.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 188
        7⤵
        Program crash
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        6⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5181.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        6⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47023.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        6⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60313.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        6⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25042.exe
        5⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        6⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
        5⤵
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43314.exe
        5⤵
        
        PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23169.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28628.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27025.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14013.exe
        6⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11046.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        6⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64097.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30754.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28649.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2488
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 188
        6⤵
        Program crash
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        5⤵
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        5⤵
        
        PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        5⤵
        
        PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
      4⤵
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23832.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61476.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57621.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        7⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        8⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        7⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exe
        7⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38497.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        7⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51709.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        6⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        6⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        5⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25210.exe
        6⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        5⤵
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62047.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exe
        6⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        7⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63578.exe
        5⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        6⤵
        
        PID:2360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 236
        6⤵
        Program crash
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe
        5⤵
        
        PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22363.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
        5⤵
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37938.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
      4⤵
      PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40368.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27348.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
      4⤵
      PID:5228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24352.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
        6⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        7⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64495.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        8⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        6⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        6⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        7⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
        5⤵
        
        PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        5⤵
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62989.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
      4⤵
      PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22940.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        5⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        6⤵
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        6⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        5⤵
        
        PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55067.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
      4⤵
      PID:336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exe
        5⤵
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        5⤵
        
        PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
      4⤵
      PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55707.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
      4⤵
      PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53126.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2688.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
      4⤵
      PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
    3⤵
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53396.exe
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22034.exe
    3⤵
    PID:5612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39043.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28073.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        8⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35498.exe
        7⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34098.exe
        8⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        8⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        8⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
        6⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe
        6⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        6⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56142.exe
        6⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46874.exe
        7⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        7⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        6⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1314.exe
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        7⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30754.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        6⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
        5⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        6⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        6⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        6⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40368.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27348.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36665.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7460.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52814.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        7⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        6⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
        5⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        6⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15087.exe
        7⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        5⤵
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46447.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exe
        5⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        5⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12789.exe
      4⤵
      PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22410.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23832.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
      4⤵
      PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57600.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        6⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        7⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        6⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        6⤵
        
        PID:676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22410.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        5⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        5⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
        6⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47040.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        5⤵
        
        PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
      4⤵
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        5⤵
        
        PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1679.exe
      4⤵
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26248.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
      4⤵
      PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        5⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15203.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        6⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        5⤵
        
        PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
      4⤵
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
      4⤵
      PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
      4⤵
      PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28384.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
      4⤵
      PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-227.exe
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23832.exe
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
    3⤵
    PID:5212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31586.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24352.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        5⤵
        Executes dropped EXE
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
        5⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
        6⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
        5⤵
        
        PID:292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22940.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50008.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        5⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18478.exe
        6⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7164.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
      4⤵
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        5⤵
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
      4⤵
      PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57771.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52385.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        5⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39068.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14195.exe
        5⤵
        
        PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
      4⤵
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
        5⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18277.exe
        6⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59467.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29962.exe
      4⤵
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14232.exe
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
      4⤵
      PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
    3⤵
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40368.exe
    3⤵
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27348.exe
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24367.exe
    3⤵
    PID:5316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        5⤵
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
        5⤵
        
        PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53760.exe
      4⤵
      PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43676.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
      4⤵
      PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
      4⤵
      PID:5368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
    3⤵
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63197.exe
    3⤵
    PID:2396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
    3⤵
    PID:5608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
      4⤵
      PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exe
      4⤵
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41289.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60189.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27634.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58726.exe
    3⤵
    PID:480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
      4⤵
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        5⤵
        
        PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
      4⤵
      PID:5572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
    3⤵
    PID:3784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
    3⤵
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
    3⤵
    PID:5236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
    3⤵
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24143.exe
      4⤵
      PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe
    3⤵
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
    3⤵
    PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
    3⤵
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
  2⤵
  PID:2628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
  2⤵
  PID:3684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58879.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58879.exe
  2⤵
  PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-31586.exe

Filesize
468KB

MD5
ef8cc97104bd1a813c1d67ff2dbec17e

SHA1
ce584e8cbf39b91acbf9d99202826207cee30948

SHA256
d73078b779e9a3a1e98e5092a9f7576c38850871c222d04669fd9005e6a5281c

SHA512
018ee7b72301efb0e3acf44b7818f7a3146856a5699e247e562f759946dee86b4e67c464481e44388baef0651443f99ebe141bfe1cf21a5bf7f4c8466ef8fa8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe

Filesize
468KB

MD5
693eac82f105de41b599b0cfb2de2af1

SHA1
6ac16b31b1ad3d4b0469f5eba6f5a4bcc41638ce

SHA256
82f5ebdde564be0524575032c4edef9596279c1cd61094fc8a3e0a71bc9bff85

SHA512
ace018e419d7f9b5b138852189c76c0381ddd301138cfd89b6c511f201dbce30b592377f6cd65fdbc7ad38f6fb72759706f03f233aabb0834958353918afc986

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe

Filesize
468KB

MD5
da5147d91c550e236d168ed2cf3116cc

SHA1
8c7d28d156b99ce7c6b71e2a06450767698c183d

SHA256
da4622b300bda655ca198c77fe4272dbdf9c5812120955a31ac95baced581a21

SHA512
9c7342c674cbc3ef80fc0961641f7b1e1b77c8864c4bfdc6474c4182fc11d77111130da758b734a5471a57609c36c717da6c84c4d7290e6e998753ab240aa683

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe

Filesize
468KB

MD5
c301a619160dfb056dc840cb6e86bd1b

SHA1
c6ed6a665cd5fecb63e55c1445fee610e5d5022b

SHA256
a36c5e11b71d430ef2f4dfbfce513075f6fa9285cab7231deb583ff7305217bc

SHA512
d92871ec769f9e9fa772c8aaaf395163d3a2108c87c02ed668fbd8714bf0f713272e53b29a6b717f8ec30d5a7d730dfa43e567fdaa336eb21ee6f6a21fb826e6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe

Filesize
468KB

MD5
068220e7935dda1602fde42dac5df51b

SHA1
580fcbd8f05b45ccdc32e3b760c378f933e54ed4

SHA256
8ddd39096ac8177aae5c5c4004773b9f454279333cc6a3ffc8d67fcfab5f7731

SHA512
37b2312d16cf860df144a413a0d8e26eac5964a6f5a7ad29ad314cf1456bf2c04d60216aaddbcd025c9e1e1894eb2da85c482e8de9e7bb5ef2a3ccc18fe360ec

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe

Filesize
468KB

MD5
612d554c5d8036c95a089e455625e28c

SHA1
cbf93a2462fb7ded4168f3d8c11c298a7dbe33d4

SHA256
d62d73bba0c5779a3d31d55070e331e0c5600f878c9c8c4353ee6609fa3f25ee

SHA512
07a5fa6a87a552a9e606c6db951db14bc9bc57c5ab5e2acc67bbd4dce8c7e202856ff5d5e3772f0367835881cdd54bafcba35eab08827c4f31311fb6f53016c6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35862.exe

Filesize
468KB

MD5
e4614a4718a160fcc716e371b364f9f7

SHA1
8f53fce2e8d3ff182fd9cd20efcf086c5e56416a

SHA256
5aa2bdc2ef10ba52a3e85f34763ab81818edcab3a541d358a8f7a1c40693ba53

SHA512
afb86dec2833d02a10b4e20c55412c2f18681863bb8c87e07cf0e6b292250e3fe58a9af09a034611fa6d0b86a80de82a49609736cd16138904dddf5f83f1ee57

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe

Filesize
468KB

MD5
ab5c7f578a4e2b7774879423349bab33

SHA1
f9942ba0433a2d2037b6aac47f81a84de8d3fe41

SHA256
fcb04a8f3311c12b8883cca24d9c42c1254544038ae3c137b792ca256b331e9a

SHA512
c704b429a3072509166e5b2e5b49fe38527c14e1578a4a1cb400017cd47eb421cbaca0a726b46575b101bdc208155d0db56dc4d7920bdbf8b858a8134476e28e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36665.exe

Filesize
468KB

MD5
0a0f3824c2201722ad3459c77c65732f

SHA1
71e00e6f2835925957750ed534321193e384b7e3

SHA256
053b443f5471dc3678b5fd8d4e7b194df14a81103ce07c70784f0bf58e58e6a2

SHA512
e683c135e58da3911f5b18dcda940e8cab51724497cb48a2195c02903b3311cb33dca1e9a254b80e0370fb2411cb15c63482a71325d4c01e47e19cf1f2492a63

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39043.exe

Filesize
468KB

MD5
e68ee1d078ae65c0ce8417c2b0b5aa78

SHA1
9906fba6b641febbea7455c461d463b74f229f04

SHA256
eb5a1b5596f45606357770097001c870ee754e4065d83d0b5ad96d0cd5933718

SHA512
c603b07f585c273293cbd9fa1ba4d6d43eaec9e973e287b65be85a732e1f26773f835831cecaa1ecb0f8138d75a38071008ee81a92a41b265aa05fa7c1ae150d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45706.exe

Filesize
468KB

MD5
d920f8139ba546fcb1be215f1c1b5893

SHA1
72ae368b9a3a1655cb488da6195dfae203232d42

SHA256
83ab722036bd1d94b81a6f1a1a593b10e11f04e5622f67d3163baf05fb3e8e3e

SHA512
90cb8f862253d33e1f6fca002d993e5ea06f6084d2d6d2083050ea260b7b5f8a4ac936617df61666cadae2675073bfaed10f850649a77d6876e5022512bf2dc6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe

Filesize
468KB

MD5
32823b1888b41be8d6893fcf43827022

SHA1
d5b8c386cd4fa6ceffdc1663b046449c6efd1348

SHA256
6e118b5ff64a8c413b5318e75a335d24f5967d2a0ce7d3dfab245d76bddd57da

SHA512
48774c873e8024d6ac83028b38f7f30016a9e2e87eacf42a595952381381ef3d338103e2fc6b7c41994079e53a8a6c31da6af911da3f050852ba63d25dbad15f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57600.exe

Filesize
468KB

MD5
7faed5f6c631e34a679c1656c839680d

SHA1
13f0d0a2428434e13c6ce53714ee5c4a3e18d560

SHA256
2c6b2973e742fb86601de9604bc8892f13056e3fd40b7dccd0c0365a402192ef

SHA512
fe2e3b0e2864eadcd8fb04f285d0ee14b6b88921aba7922504b192a7ce4e0552d2705f11cf1684412a085eb81d568d5f188595f0e3f0d1b32877e3b11264a8f9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe

Filesize
468KB

MD5
ce95c185b8504a9d7817f3f7d8753409

SHA1
984076f36a27dd5f239a14876317e02a985127ee

SHA256
eee844e2ff039cc755a310011c05481ede746463290c9660c32ae1f8a9d2c641

SHA512
d6ed0a1a5b5acf6b57b99e2f1bbf08f4cb43f464f0139fd90043daf8e11cfdf9028a9e238794ec84eeb9be6baf0cbe98ec14135636d5370ee899807612b4edf0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe

Filesize
468KB

MD5
6a25acb28ba9efef4867c3f1518308af

SHA1
e86dd08e5553ba732d05e4ebcabc1f78324e27f4

SHA256
4e21656ef92bd9ca9bae5b8a180bba85b9fe818f30b7a61c6490e2ef7d9377e7

SHA512
088605f34a7c33c373d5c5ff2f2444e06ce51b1b25f440b353ed80c8be7eabc576125aab1578ea6444e4affd20e4122135459a0df1734dafe63e44c6d3f0b1a5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61476.exe

Filesize
468KB

MD5
f50aa56f7b8dd0c3bfe0a6c5cfb0daf4

SHA1
7563670a0c1b1594243d2162c4f2a7b701b16e0a

SHA256
85138db5bfe8c119931ae1621c9b5ce6fd06d4dda54add4ee1e658b3a49cd313

SHA512
ec5a4515cadbadb26c355877d8a30f4e2ab1a7c4808eced9f4e26bd29e82bfbe9ec0225b4fbd0ab35f852e612dcc9aba5cc75c0003dd93b221aba5ce18abc4da

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-755.exe

Filesize
468KB

MD5
d34ea9e38de151cec579f6898b4394aa

SHA1
a67798e704e298a4f9bc26f3402adf044971e33e

SHA256
51d430a53e1a30e073d675166b0ae38060978b7a4ca56d596d1d3e9e45cc201d

SHA512
c8bf2fb4d3b84993e1174efde495229ad324a3568cc6faba6a191281a1867592cec40ff80ca93fb743dc85ce35bceb440baf65768a6021601d303d5fd4d2c02a

Download Submit