634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfee

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
Size

468KB
MD5

5ba2d6aa9f7b57456913ee01c9473730
SHA1

bc9f9d7d92ce57d28d082830c05513f014dde789
SHA256

634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfee
SHA512

0985c0e3c10d7bae078d257b1c60d0a76fe004ac0671a893baa15e75d05ead159521927ee3e47723e917726b0b4f2c207333a30f373ea31923731d855621d136
SSDEEP

3072:ZnCpovIwUk5/5bYAPgc5Of8nE5RhNIXwlmHoxS67xIQwGhNa7Uly:ZnAoIs/5LPV5Ofr2SvxINWNa7

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2704	Unicorn-25425.exe
2628	Unicorn-28736.exe
2744	Unicorn-33566.exe
1680	Unicorn-14065.exe
2572	Unicorn-24271.exe
2372	Unicorn-33713.exe
2160	Unicorn-38543.exe
1696	Unicorn-17953.exe
664	Unicorn-9519.exe
1484	Unicorn-49696.exe
324	Unicorn-53842.exe
896	Unicorn-7978.exe
2500	Unicorn-10208.exe
2188	Unicorn-16339.exe
2176	Unicorn-14637.exe
2196	Unicorn-3702.exe
1980	Unicorn-23568.exe
596	Unicorn-20034.exe
1840	Unicorn-8144.exe
1492	Unicorn-44346.exe
284	Unicorn-13711.exe
1760	Unicorn-11673.exe
1984	Unicorn-26976.exe
336	Unicorn-30314.exe
1764	Unicorn-37712.exe
2972	Unicorn-63178.exe
1176	Unicorn-43229.exe
2024	Unicorn-63095.exe
3032	Unicorn-24292.exe
2304	Unicorn-30423.exe
876	Unicorn-34869.exe
2448	Unicorn-54735.exe
1596	Unicorn-46878.exe
2380	Unicorn-2581.exe
2668	Unicorn-22372.exe
2644	Unicorn-44608.exe
2260	Unicorn-24484.exe
2632	Unicorn-19422.exe
2512	Unicorn-25553.exe
2520	Unicorn-38167.exe
2016	Unicorn-49865.exe
1968	Unicorn-62864.exe
2588	Unicorn-17193.exe
1988	Unicorn-9335.exe
3048	Unicorn-17769.exe
2484	Unicorn-3278.exe
3040	Unicorn-1240.exe
2388	Unicorn-45952.exe
1888	Unicorn-24785.exe
2384	Unicorn-24593.exe
2984	Unicorn-37975.exe
1732	Unicorn-24744.exe
2104	Unicorn-24977.exe
2916	Unicorn-24977.exe
1056	Unicorn-13859.exe
816	Unicorn-43233.exe
1900	Unicorn-34302.exe
916	Unicorn-53046.exe
2076	Unicorn-33180.exe
1844	Unicorn-14243.exe
2492	Unicorn-44878.exe
1752	Unicorn-44878.exe
3016	Unicorn-40196.exe
1932	Unicorn-43726.exe

Loads dropped DLL 64 IoCs

pid	Process
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
2704	Unicorn-25425.exe
2704	Unicorn-25425.exe
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2744	Unicorn-33566.exe
2744	Unicorn-33566.exe
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
1680	Unicorn-14065.exe
1680	Unicorn-14065.exe
2744	Unicorn-33566.exe
2744	Unicorn-33566.exe
2572	Unicorn-24271.exe
2572	Unicorn-24271.exe
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
2372	Unicorn-33713.exe
2372	Unicorn-33713.exe
1680	Unicorn-14065.exe
1680	Unicorn-14065.exe
2160	Unicorn-38543.exe
2160	Unicorn-38543.exe
2744	Unicorn-33566.exe
2744	Unicorn-33566.exe
1696	Unicorn-17953.exe
1696	Unicorn-17953.exe
2572	Unicorn-24271.exe
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
2572	Unicorn-24271.exe
664	Unicorn-9519.exe
664	Unicorn-9519.exe
1484	Unicorn-49696.exe
1484	Unicorn-49696.exe
2372	Unicorn-33713.exe
2372	Unicorn-33713.exe
324	Unicorn-53842.exe
324	Unicorn-53842.exe
1680	Unicorn-14065.exe
1680	Unicorn-14065.exe
896	Unicorn-7978.exe
896	Unicorn-7978.exe
2160	Unicorn-38543.exe
2160	Unicorn-38543.exe
2176	Unicorn-14637.exe
2176	Unicorn-14637.exe
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
1980	Unicorn-23568.exe
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
1980	Unicorn-23568.exe
2196	Unicorn-3702.exe
664	Unicorn-9519.exe
2196	Unicorn-3702.exe
664	Unicorn-9519.exe
2572	Unicorn-24271.exe
2572	Unicorn-24271.exe
2188	Unicorn-16339.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2808	2628	WerFault.exe	31
2948	3016	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14450.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
2704	Unicorn-25425.exe
2744	Unicorn-33566.exe
2628	Unicorn-28736.exe
1680	Unicorn-14065.exe
2572	Unicorn-24271.exe
2372	Unicorn-33713.exe
2160	Unicorn-38543.exe
1696	Unicorn-17953.exe
664	Unicorn-9519.exe
1484	Unicorn-49696.exe
324	Unicorn-53842.exe
896	Unicorn-7978.exe
2176	Unicorn-14637.exe
2188	Unicorn-16339.exe
2500	Unicorn-10208.exe
1980	Unicorn-23568.exe
2196	Unicorn-3702.exe
596	Unicorn-20034.exe
1492	Unicorn-44346.exe
1840	Unicorn-8144.exe
284	Unicorn-13711.exe
1760	Unicorn-11673.exe
1984	Unicorn-26976.exe
336	Unicorn-30314.exe
1764	Unicorn-37712.exe
2972	Unicorn-63178.exe
1176	Unicorn-43229.exe
2024	Unicorn-63095.exe
3032	Unicorn-24292.exe
2304	Unicorn-30423.exe
876	Unicorn-34869.exe
2448	Unicorn-54735.exe
1596	Unicorn-46878.exe
2380	Unicorn-2581.exe
2668	Unicorn-22372.exe
2644	Unicorn-44608.exe
2260	Unicorn-24484.exe
2632	Unicorn-19422.exe
2520	Unicorn-38167.exe
2016	Unicorn-49865.exe
2512	Unicorn-25553.exe
1968	Unicorn-62864.exe
2588	Unicorn-17193.exe
1988	Unicorn-9335.exe
3048	Unicorn-17769.exe
3040	Unicorn-1240.exe
2388	Unicorn-45952.exe
2484	Unicorn-3278.exe
1888	Unicorn-24785.exe
2384	Unicorn-24593.exe
2984	Unicorn-37975.exe
1732	Unicorn-24744.exe
2104	Unicorn-24977.exe
2916	Unicorn-24977.exe
1900	Unicorn-34302.exe
1056	Unicorn-13859.exe
816	Unicorn-43233.exe
2076	Unicorn-33180.exe
916	Unicorn-53046.exe
1844	Unicorn-14243.exe
1752	Unicorn-44878.exe
2492	Unicorn-44878.exe
3016	Unicorn-40196.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2704	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	30
PID 1476 wrote to memory of 2704	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	30
PID 1476 wrote to memory of 2704	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	30
PID 1476 wrote to memory of 2704	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	30
PID 2704 wrote to memory of 2628	2704	Unicorn-25425.exe	31
PID 2704 wrote to memory of 2628	2704	Unicorn-25425.exe	31
PID 2704 wrote to memory of 2628	2704	Unicorn-25425.exe	31
PID 2704 wrote to memory of 2628	2704	Unicorn-25425.exe	31
PID 1476 wrote to memory of 2744	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	32
PID 1476 wrote to memory of 2744	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	32
PID 1476 wrote to memory of 2744	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	32
PID 1476 wrote to memory of 2744	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	32
PID 2628 wrote to memory of 2808	2628	Unicorn-28736.exe	33
PID 2628 wrote to memory of 2808	2628	Unicorn-28736.exe	33
PID 2628 wrote to memory of 2808	2628	Unicorn-28736.exe	33
PID 2628 wrote to memory of 2808	2628	Unicorn-28736.exe	33
PID 2744 wrote to memory of 1680	2744	Unicorn-33566.exe	34
PID 2744 wrote to memory of 1680	2744	Unicorn-33566.exe	34
PID 2744 wrote to memory of 1680	2744	Unicorn-33566.exe	34
PID 2744 wrote to memory of 1680	2744	Unicorn-33566.exe	34
PID 1476 wrote to memory of 2572	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	35
PID 1476 wrote to memory of 2572	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	35
PID 1476 wrote to memory of 2572	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	35
PID 1476 wrote to memory of 2572	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	35
PID 1680 wrote to memory of 2372	1680	Unicorn-14065.exe	36
PID 1680 wrote to memory of 2372	1680	Unicorn-14065.exe	36
PID 1680 wrote to memory of 2372	1680	Unicorn-14065.exe	36
PID 1680 wrote to memory of 2372	1680	Unicorn-14065.exe	36
PID 2744 wrote to memory of 2160	2744	Unicorn-33566.exe	37
PID 2744 wrote to memory of 2160	2744	Unicorn-33566.exe	37
PID 2744 wrote to memory of 2160	2744	Unicorn-33566.exe	37
PID 2744 wrote to memory of 2160	2744	Unicorn-33566.exe	37
PID 2572 wrote to memory of 1696	2572	Unicorn-24271.exe	38
PID 2572 wrote to memory of 1696	2572	Unicorn-24271.exe	38
PID 2572 wrote to memory of 1696	2572	Unicorn-24271.exe	38
PID 2572 wrote to memory of 1696	2572	Unicorn-24271.exe	38
PID 1476 wrote to memory of 664	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	39
PID 1476 wrote to memory of 664	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	39
PID 1476 wrote to memory of 664	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	39
PID 1476 wrote to memory of 664	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	39
PID 2372 wrote to memory of 1484	2372	Unicorn-33713.exe	40
PID 2372 wrote to memory of 1484	2372	Unicorn-33713.exe	40
PID 2372 wrote to memory of 1484	2372	Unicorn-33713.exe	40
PID 2372 wrote to memory of 1484	2372	Unicorn-33713.exe	40
PID 1680 wrote to memory of 324	1680	Unicorn-14065.exe	41
PID 1680 wrote to memory of 324	1680	Unicorn-14065.exe	41
PID 1680 wrote to memory of 324	1680	Unicorn-14065.exe	41
PID 1680 wrote to memory of 324	1680	Unicorn-14065.exe	41
PID 2160 wrote to memory of 896	2160	Unicorn-38543.exe	42
PID 2160 wrote to memory of 896	2160	Unicorn-38543.exe	42
PID 2160 wrote to memory of 896	2160	Unicorn-38543.exe	42
PID 2160 wrote to memory of 896	2160	Unicorn-38543.exe	42
PID 2744 wrote to memory of 2500	2744	Unicorn-33566.exe	43
PID 2744 wrote to memory of 2500	2744	Unicorn-33566.exe	43
PID 2744 wrote to memory of 2500	2744	Unicorn-33566.exe	43
PID 2744 wrote to memory of 2500	2744	Unicorn-33566.exe	43
PID 1696 wrote to memory of 2188	1696	Unicorn-17953.exe	44
PID 1696 wrote to memory of 2188	1696	Unicorn-17953.exe	44
PID 1696 wrote to memory of 2188	1696	Unicorn-17953.exe	44
PID 1696 wrote to memory of 2188	1696	Unicorn-17953.exe	44
PID 1476 wrote to memory of 2176	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	46
PID 1476 wrote to memory of 2176	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	46
PID 1476 wrote to memory of 2176	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	46
PID 1476 wrote to memory of 2176	1476	634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe	46

C:\Users\Admin\AppData\Local\Temp\634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe
"C:\Users\Admin\AppData\Local\Temp\634a6a6ce5de36bc75823a3e1b6c5fcc37452dc0a91a13fd9c630be482bbcfeeN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 200
      4⤵
      Loads dropped DLL
      Program crash
      PID:2808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43726.exe
      4⤵
      Executes dropped EXE
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        5⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39158.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7597.exe
      4⤵
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
        5⤵
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        5⤵
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
      4⤵
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
      4⤵
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12899.exe
    3⤵
    PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
      4⤵
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35416.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
      4⤵
      PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
      4⤵
      PID:6252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
      4⤵
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20283.exe
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
    3⤵
    PID:4020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
    3⤵
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
    3⤵
    PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50321.exe
    3⤵
    PID:5176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33713.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49696.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34235.exe
        8⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe
        9⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        9⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        9⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        9⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        9⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        8⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        8⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
        9⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        9⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        9⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
        9⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        8⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        8⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        8⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27580.exe
        7⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exe
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
        7⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
        7⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44608.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34671.exe
        8⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        8⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
        7⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
        7⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27463.exe
        7⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        7⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
        6⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        7⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        7⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
        8⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        8⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        8⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        7⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        6⤵
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
        6⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
        7⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56575.exe
        6⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48724.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2773.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25283.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27831.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49197.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37646.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60167.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53842.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25553.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        8⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
        9⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24728.exe
        9⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        8⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
        8⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8217.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41743.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        7⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        7⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        6⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
        7⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30415.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31646.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31479.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38167.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
        6⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        7⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        7⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
        6⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27382.exe
        7⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32188.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19838.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3752.exe
        6⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        5⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        6⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        6⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        6⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exe
        5⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
        5⤵
        
        PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17193.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        6⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5942.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        7⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        7⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exe
        6⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58406.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14822.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46983.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
        5⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        6⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        7⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        7⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
        5⤵
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9335.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32813.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
      4⤵
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        5⤵
        
        PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-342.exe
      4⤵
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54712.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
      4⤵
      PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
      4⤵
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16182.exe
      4⤵
      PID:7008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38543.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46232.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21908.exe
        6⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13373.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
        6⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46160.exe
        6⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-617.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
        7⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51739.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
        5⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26976.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34671.exe
        6⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13905.exe
        7⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63654.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        6⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58187.exe
        6⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60711.exe
        5⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63309.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60747.exe
      4⤵
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31514.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
      4⤵
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
      4⤵
      PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
      4⤵
      PID:6928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54735.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        6⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        5⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19135.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        6⤵
        
        PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64146.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47312.exe
        5⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
        6⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        6⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
        5⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8810.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62068.exe
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27382.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18547.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        5⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        6⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21349.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        5⤵
        
        PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
      4⤵
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        5⤵
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        5⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
      4⤵
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
      4⤵
      PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20694.exe
    3⤵
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3088.exe
      4⤵
      PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
      4⤵
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
      4⤵
      PID:6376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
    3⤵
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
      4⤵
      PID:2472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe
    3⤵
    PID:4244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
    3⤵
    PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
    3⤵
    PID:6832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24271.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24271.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16339.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30423.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44920.exe
        7⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        7⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33222.exe
        6⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40196.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 220
        6⤵
        Program crash
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25219.exe
        5⤵
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        5⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34869.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32813.exe
        6⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9349.exe
        7⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe
        5⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
        6⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
        5⤵
        
        PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14243.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46766.exe
        5⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
      4⤵
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9052.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2617.exe
      4⤵
      PID:7004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6077.exe
        6⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14281.exe
        5⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44920.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exe
      4⤵
      PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
      4⤵
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
      4⤵
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24292.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
      4⤵
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8319.exe
        5⤵
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
      4⤵
      PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
      4⤵
      PID:6912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10980.exe
    3⤵
    PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27837.exe
      4⤵
      PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
      4⤵
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
      4⤵
      PID:6444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3255.exe
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37646.exe
    3⤵
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4334.exe
    3⤵
    PID:2092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
    3⤵
    PID:5620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
    3⤵
    PID:6440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31350.exe
        6⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        6⤵
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35412.exe
        5⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
        6⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37975.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5942.exe
        5⤵
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        5⤵
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25712.exe
      4⤵
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52533.exe
        5⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
        5⤵
        
        PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
      4⤵
      PID:444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
      4⤵
      PID:6316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        5⤵
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5750.exe
      4⤵
      PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
      4⤵
      PID:6744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
      4⤵
      PID:964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62822.exe
      4⤵
      PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58132.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
    3⤵
    PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
    3⤵
    PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
    3⤵
    PID:6412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30314.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1240.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32813.exe
        5⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8373.exe
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        5⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5785.exe
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe
      4⤵
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41467.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
      4⤵
      PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28672.exe
      4⤵
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46238.exe
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
      4⤵
      PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
    3⤵
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
      4⤵
      PID:5992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
    3⤵
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
    3⤵
    PID:4936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
    3⤵
    PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
    3⤵
    PID:5192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30390.exe
      4⤵
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        5⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
      4⤵
      PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
      4⤵
      PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
      4⤵
      PID:7116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
    3⤵
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
    3⤵
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
    3⤵
    PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
    3⤵
    PID:6312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34671.exe
    3⤵
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
      4⤵
      PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
      4⤵
      PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
      4⤵
      PID:7100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13373.exe
    3⤵
    PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
    3⤵
    PID:7124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4740.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4740.exe
  2⤵
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
    3⤵
    PID:6052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
  2⤵
  PID:4876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
  2⤵
  PID:5932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
  2⤵
  PID:6220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe

Filesize
468KB

MD5
4fe7b2c07513a608fa9c7689e3eb6550

SHA1
d689951a02f8568da3c3766f1b7fee4169fa1617

SHA256
396c225de8a3395a70b6abe539e2aa153f89a9556351f4df538a6d9961677204

SHA512
233e82b9a691e5da982f5523b56208b8a7cddf6d6b745fc2f8a537ff083dfbe74357ed3b296128f872fe2ceabe1a1a2cf36fdd89bded995d36b34aba1c83f4f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe

Filesize
468KB

MD5
f4d8097a26df2b077071456e6c8c3a68

SHA1
b0f1d51e33472e8753f63b5d7e544827d533db5b

SHA256
0ebe928d28c48e7b77444213023e7e344f643ee7eaf09f70092c5fd42b74cb3a

SHA512
9bde6c1e7013937a60fa7652be806a1bee332c4f36c3051e72dfa8937c1d2133e46bb329d96b70c5e055e6c6133c2b5ec86990aa1a8a1566c62b279157c603ec

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe

Filesize
468KB

MD5
7cf6347c3b9e686d722887da3f6b4782

SHA1
80eacac1d4404a4e0ba8d80a491f3a4d72b15fa7

SHA256
768fe3a68da97965c72de1c8f133fdfae79b8e6d96ed2287da4b5cee6560bb42

SHA512
d9877b0fad95353eeaa544ac7be916e7efe3b6f177dbf262461fdad7d44b161f6d4a590b3ea766e94f74d08a242c9826d6ed62a5107085ff90c86795d9c93126

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe

Filesize
468KB

MD5
22e4f40626a35da53bedf4cbb70f130b

SHA1
9e5f86475373697764ad676f4cf1463203a2335a

SHA256
785cbdf61da54045a8dbea1072dd9e53d58b72d24d0793d8200dae184374d71b

SHA512
a7656ba29f9919f58bedc72fb582e5a72708f85b0c124473600252180c60e271d6d3a46b9970afb2353da8b234cf61a231023aa771d3dc0325936269c7e224ac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe

Filesize
468KB

MD5
f640284be3b22958ba255026efac5815

SHA1
d5632f6358ee8b5a92d5254a835e9114458c8e0d

SHA256
e5e7be76a98fe8c52d8b8f73d49b0be58d8ca94df70fd454877fca02c56447c1

SHA512
29baf2a376530b1aeb1a1e61492c9ff84604b924208a94e32be946c5a97953366f5705bf4741befc6bf46bc08d33dbc481d34ae38d4ce9b15e845ff758ec7a24

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16339.exe

Filesize
468KB

MD5
be031f828bf7ba87aa69f03011a74698

SHA1
3335af186cf66376e54a68d530ac35d5b16b9416

SHA256
f09afa871e7b9fd6e0f8f7302cd300d7e574b11af99cf6ada1253e404166927f

SHA512
388bcf49067555880858bf2ce17d10e5f1db5d25b264035c0d23f937289266dfe19276718a3a249d75e8703349162284cde516ba91bc31059703569bf685c7a7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

Filesize
468KB

MD5
df7cb62ef3ffae29060109295d044109

SHA1
68f271f3ac79950ea67c192756f18c29217a1a02

SHA256
3272589e9614aef1b6574cf07fa942a2183d8585a632a1f9fed46636f1f7c2f8

SHA512
71ed1dd4698b491cda8a752eccfb0afdf857489a95cb991a9ea0a3bf5a39ed6f1229cffe85b45202806983c0b342607825f683d05b33380cda08b89c44ef98fc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24271.exe

Filesize
468KB

MD5
23426476420340189a6c11a3143f466d

SHA1
a570da9d64d1e3668a4650be3deb4c3affe1700d

SHA256
ab282751b8786884f8934dbb822fca5d57de5a804166018c4ce2ae06e0ef20fb

SHA512
b4855506088c30eb962dff585aa32124e33306c453e9af6207b943cf74f5888b3c29b08bfb4c0aa31ac7054be15eaedb9d297561570d47d93823a7948aa5a088

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe

Filesize
468KB

MD5
474a272d1cdc112da4ed28ab013172da

SHA1
5c8cd19952008f2eb963d46a19cfe2b394dbb1a2

SHA256
25d328439318a4f12044d99764cf23a99d732f17e1b93ba8f6d60f57cab78430

SHA512
c2c69f5392705208d9da9adb02da86b5f77fe753ce55ddd9f0b8297c9b2882d92237674b3695608ae114b6bd9ba51654e248e74a72b274561c533fa976f6c711

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe

Filesize
468KB

MD5
a15f26fbde163994ce04ceb53f4c84a9

SHA1
46844656c5230f9487354f6aabfb1c20a385b287

SHA256
348b8d45b32f686e75fb7ee592b081be9426782dc1ecff93fdb1861147d22b66

SHA512
4709d72ab91c360e485ac1cee3e974f3a2e0320652105507b037bf0ab8d936c1d615d6f6fd4b1f8ecd2a71e4eebdea3a2fb7bd7500c41a86c47a627f800787fd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33713.exe

Filesize
468KB

MD5
9381e510d072b9707c5d19d12d217dbb

SHA1
e744c76f44899ed68bacc2c191312861c15bedd7

SHA256
5aa843748e0f9306312828a3307b6ede0a6bd290da1669653ec0491776ce7058

SHA512
b171748808b1cea4f284bd76fa3539f5be0e8d98ddf07ebad914abd59506a5aca2c33e55ca72bc59587a8c8b128b93fad5365e1566ff2d89d463f55d55fa5dea

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe

Filesize
468KB

MD5
fe8886d98273ae84ea17b701e4f838f3

SHA1
060de2d48c682b5a3d1bd855d2b4ab41f07fd62c

SHA256
d0fe505a2e4ed04aaf55ca5f4a8a0b7c04d8cecda8469cc81730b2856ebcb271

SHA512
d9e6bdb32b99b7363a3cd5e7919b32ca6e69e183e8bb71221a5fa9d9f78c67bd37a20b2fa44859c7305d8dac7f75b176848bd1a0221c90c448d24169d786f46a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38543.exe

Filesize
468KB

MD5
25d545d5d8bd162ec472c60bba0269e9

SHA1
431ad22f5a17c67fce169ffb7d14a25786beb84f

SHA256
a922fe3641c2c31d216fa5306a18a37698a5dab26e8afe5a7ea5122b181219af

SHA512
a9d6531641415fb0b68311d41742f017d243f460ae80ff0b3a285cd548c1c150a3ba35cce1684313ac452b234daa74394811554ed5cbfb339433e6723805bdc7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49696.exe

Filesize
468KB

MD5
974114d82aef99aebb62d9b6285c66dc

SHA1
e5bd837b9ba1a7b244ae99405fdc07a2e8b1a369

SHA256
3facc7f4dab22eb5ed28fd7344ca4763faef0327e8ae02931183dc64567a7b20

SHA512
77eafcab4aa29f940a61e21533c87f841fde8d0154686b91c68c8b50bd2097aa892fa2def5affc6fde2e73e71a46b7deefc79dbab8965e485bf08c15d156dca4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53842.exe

Filesize
468KB

MD5
783d36f13ea8ea5eb60d4c0377daefe4

SHA1
69bfa7de6cf97a2b52d5905d3af113ff0de34da6

SHA256
5f0b5ecfed88db03d8185a1fd6a5b29a85220c2ffe77cd698837ee6f113b404d

SHA512
02b56140b133f011cc536309767642146a84c956e06298552a04d9f098aa17ce3abca5b2186cc383127162137fa8c64fe029cfe812b1d91a5cc5a45ff5c8ffcf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe

Filesize
468KB

MD5
e2b8b01984b026122b155423c4804c79

SHA1
672e13eb9a37163d114fe9d2d6ee55c63857340b

SHA256
139c50654df58f6cacaffe923a0774756cc0548e5e2a14f402d50f2fb37fc705

SHA512
47634f68c0e90198cf6ea716690f11e4ff14ed361dbc4fa152c2269b8901c8651f0c6302ca71eab4b9366711523676aafcf12ffa33c6c83b5a1628194fd2140b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe

Filesize
468KB

MD5
7e5b0676449756f7fc29e734c19c8e5a

SHA1
303b529091353261e55d0ae3d7c73f4a8fd977fe

SHA256
9e96d38f3b505b762a8b61f4e1219703edd441f24075af92ebb2def365e18241

SHA512
323a9491b9754e31e3f199d84fdac49e7f307846e770bda613991b9c0d9e8282f726ef0fa16903f7979794672e152d397f500b0741bad18861e22f9d70dfdc1a

Download Submit