09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8a

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
Size

468KB
MD5

e2de91b124c00283494aced6edc2ae10
SHA1

ad56dad5043d8bfb05002e874c040977a793b319
SHA256

09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8a
SHA512

f92d46625e4f6045d5899e9523ef9e00b9747c127d75652b9e7b06ab9fd319278b1fd17020e4aa0077320f27a7cc789224f5eae6b57e2eaa4e043e6ade276733
SSDEEP

3072:1bzrov0TyK5XtbYhPgGBOfN/xCgoHIpXHmHewSDu1ZTwMx+uQ5lh:1b3o9OXtePXBOfe0BC1Zs0+uQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2168	Unicorn-20552.exe
2200	Unicorn-13618.exe
1264	Unicorn-14173.exe
2784	Unicorn-46037.exe
2968	Unicorn-39907.exe
2688	Unicorn-21533.exe
2872	Unicorn-18003.exe
2572	Unicorn-43188.exe
2104	Unicorn-11262.exe
1952	Unicorn-35212.exe
1548	Unicorn-50654.exe
2000	Unicorn-61423.exe
868	Unicorn-15752.exe
1976	Unicorn-15752.exe
2792	Unicorn-27739.exe
2008	Unicorn-36639.exe
2864	Unicorn-33109.exe
600	Unicorn-20111.exe
3044	Unicorn-27192.exe
916	Unicorn-33323.exe
2928	Unicorn-45118.exe
1392	Unicorn-61719.exe
2040	Unicorn-7672.exe
2176	Unicorn-16603.exe
2224	Unicorn-821.exe
832	Unicorn-11449.exe
1356	Unicorn-28724.exe
2280	Unicorn-458.exe
2312	Unicorn-5511.exe
1300	Unicorn-1060.exe
2384	Unicorn-22462.exe
2024	Unicorn-53088.exe
888	Unicorn-59218.exe
2352	Unicorn-43436.exe
1716	Unicorn-49981.exe
1480	Unicorn-55326.exe
636	Unicorn-35460.exe
1784	Unicorn-45824.exe
2744	Unicorn-46089.exe
2060	Unicorn-5227.exe
2768	Unicorn-29177.exe
2832	Unicorn-36582.exe
2596	Unicorn-17671.exe
2696	Unicorn-37537.exe
2556	Unicorn-20239.exe
2996	Unicorn-49789.exe
2728	Unicorn-49789.exe
1992	Unicorn-44619.exe
856	Unicorn-50749.exe
2448	Unicorn-26799.exe
1396	Unicorn-24390.exe
1728	Unicorn-30521.exe
1072	Unicorn-29945.exe
1328	Unicorn-10079.exe
2016	Unicorn-3586.exe
2908	Unicorn-63001.exe
2660	Unicorn-1548.exe
352	Unicorn-34916.exe
2152	Unicorn-15315.exe
2044	Unicorn-51408.exe
2252	Unicorn-10930.exe
1852	Unicorn-10567.exe
836	Unicorn-27074.exe
912	Unicorn-46940.exe

Loads dropped DLL 64 IoCs

pid	Process
2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
2168	Unicorn-20552.exe
2168	Unicorn-20552.exe
2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
1264	Unicorn-14173.exe
2200	Unicorn-13618.exe
2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
2200	Unicorn-13618.exe
1264	Unicorn-14173.exe
2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
2168	Unicorn-20552.exe
2168	Unicorn-20552.exe
2784	Unicorn-46037.exe
2784	Unicorn-46037.exe
2200	Unicorn-13618.exe
2200	Unicorn-13618.exe
2872	Unicorn-18003.exe
2872	Unicorn-18003.exe
2168	Unicorn-20552.exe
2168	Unicorn-20552.exe
1264	Unicorn-14173.exe
1264	Unicorn-14173.exe
2688	Unicorn-21533.exe
2968	Unicorn-39907.exe
2968	Unicorn-39907.exe
2688	Unicorn-21533.exe
2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
2572	Unicorn-43188.exe
2572	Unicorn-43188.exe
2784	Unicorn-46037.exe
2784	Unicorn-46037.exe
2104	Unicorn-11262.exe
2104	Unicorn-11262.exe
2200	Unicorn-13618.exe
2200	Unicorn-13618.exe
1548	Unicorn-50654.exe
1548	Unicorn-50654.exe
2168	Unicorn-20552.exe
2168	Unicorn-20552.exe
2792	Unicorn-27739.exe
2792	Unicorn-27739.exe
2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
868	Unicorn-15752.exe
2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
868	Unicorn-15752.exe
2688	Unicorn-21533.exe
2688	Unicorn-21533.exe
1976	Unicorn-15752.exe
1976	Unicorn-15752.exe
2968	Unicorn-39907.exe
2968	Unicorn-39907.exe
2000	Unicorn-61423.exe
2000	Unicorn-61423.exe
1264	Unicorn-14173.exe
1264	Unicorn-14173.exe
2872	Unicorn-18003.exe
2872	Unicorn-18003.exe
2864	Unicorn-33109.exe
2864	Unicorn-33109.exe
2784	Unicorn-46037.exe
2008	Unicorn-36639.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	2768	WerFault.exe	71

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56357.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
2168	Unicorn-20552.exe
1264	Unicorn-14173.exe
2200	Unicorn-13618.exe
2784	Unicorn-46037.exe
2968	Unicorn-39907.exe
2872	Unicorn-18003.exe
2688	Unicorn-21533.exe
2572	Unicorn-43188.exe
2104	Unicorn-11262.exe
1548	Unicorn-50654.exe
868	Unicorn-15752.exe
2000	Unicorn-61423.exe
1976	Unicorn-15752.exe
1952	Unicorn-35212.exe
2792	Unicorn-27739.exe
2008	Unicorn-36639.exe
2864	Unicorn-33109.exe
600	Unicorn-20111.exe
3044	Unicorn-27192.exe
916	Unicorn-33323.exe
2928	Unicorn-45118.exe
1392	Unicorn-61719.exe
2040	Unicorn-7672.exe
2176	Unicorn-16603.exe
2224	Unicorn-821.exe
832	Unicorn-11449.exe
1356	Unicorn-28724.exe
2280	Unicorn-458.exe
1300	Unicorn-1060.exe
2312	Unicorn-5511.exe
2384	Unicorn-22462.exe
888	Unicorn-59218.exe
2024	Unicorn-53088.exe
2352	Unicorn-43436.exe
1716	Unicorn-49981.exe
636	Unicorn-35460.exe
1480	Unicorn-55326.exe
1784	Unicorn-45824.exe
2744	Unicorn-46089.exe
2060	Unicorn-5227.exe
2768	Unicorn-29177.exe
2832	Unicorn-36582.exe
2596	Unicorn-17671.exe
2696	Unicorn-37537.exe
2556	Unicorn-20239.exe
2996	Unicorn-49789.exe
2728	Unicorn-49789.exe
856	Unicorn-50749.exe
1992	Unicorn-44619.exe
2448	Unicorn-26799.exe
1728	Unicorn-30521.exe
1396	Unicorn-24390.exe
1072	Unicorn-29945.exe
1328	Unicorn-10079.exe
2016	Unicorn-3586.exe
2908	Unicorn-63001.exe
2660	Unicorn-1548.exe
352	Unicorn-34916.exe
2152	Unicorn-15315.exe
2044	Unicorn-51408.exe
1852	Unicorn-10567.exe
2252	Unicorn-10930.exe
2236	Unicorn-17894.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2168	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	31
PID 2528 wrote to memory of 2168	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	31
PID 2528 wrote to memory of 2168	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	31
PID 2528 wrote to memory of 2168	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	31
PID 2168 wrote to memory of 2200	2168	Unicorn-20552.exe	33
PID 2168 wrote to memory of 2200	2168	Unicorn-20552.exe	33
PID 2168 wrote to memory of 2200	2168	Unicorn-20552.exe	33
PID 2168 wrote to memory of 2200	2168	Unicorn-20552.exe	33
PID 2528 wrote to memory of 1264	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	32
PID 2528 wrote to memory of 1264	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	32
PID 2528 wrote to memory of 1264	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	32
PID 2528 wrote to memory of 1264	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	32
PID 2200 wrote to memory of 2784	2200	Unicorn-13618.exe	35
PID 2200 wrote to memory of 2784	2200	Unicorn-13618.exe	35
PID 2200 wrote to memory of 2784	2200	Unicorn-13618.exe	35
PID 2200 wrote to memory of 2784	2200	Unicorn-13618.exe	35
PID 1264 wrote to memory of 2688	1264	Unicorn-14173.exe	34
PID 1264 wrote to memory of 2688	1264	Unicorn-14173.exe	34
PID 1264 wrote to memory of 2688	1264	Unicorn-14173.exe	34
PID 1264 wrote to memory of 2688	1264	Unicorn-14173.exe	34
PID 2528 wrote to memory of 2968	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	36
PID 2528 wrote to memory of 2968	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	36
PID 2528 wrote to memory of 2968	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	36
PID 2528 wrote to memory of 2968	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	36
PID 2168 wrote to memory of 2872	2168	Unicorn-20552.exe	37
PID 2168 wrote to memory of 2872	2168	Unicorn-20552.exe	37
PID 2168 wrote to memory of 2872	2168	Unicorn-20552.exe	37
PID 2168 wrote to memory of 2872	2168	Unicorn-20552.exe	37
PID 2784 wrote to memory of 2572	2784	Unicorn-46037.exe	38
PID 2784 wrote to memory of 2572	2784	Unicorn-46037.exe	38
PID 2784 wrote to memory of 2572	2784	Unicorn-46037.exe	38
PID 2784 wrote to memory of 2572	2784	Unicorn-46037.exe	38
PID 2200 wrote to memory of 2104	2200	Unicorn-13618.exe	39
PID 2200 wrote to memory of 2104	2200	Unicorn-13618.exe	39
PID 2200 wrote to memory of 2104	2200	Unicorn-13618.exe	39
PID 2200 wrote to memory of 2104	2200	Unicorn-13618.exe	39
PID 2872 wrote to memory of 1952	2872	Unicorn-18003.exe	40
PID 2872 wrote to memory of 1952	2872	Unicorn-18003.exe	40
PID 2872 wrote to memory of 1952	2872	Unicorn-18003.exe	40
PID 2872 wrote to memory of 1952	2872	Unicorn-18003.exe	40
PID 2168 wrote to memory of 1548	2168	Unicorn-20552.exe	41
PID 2168 wrote to memory of 1548	2168	Unicorn-20552.exe	41
PID 2168 wrote to memory of 1548	2168	Unicorn-20552.exe	41
PID 2168 wrote to memory of 1548	2168	Unicorn-20552.exe	41
PID 1264 wrote to memory of 2000	1264	Unicorn-14173.exe	42
PID 1264 wrote to memory of 2000	1264	Unicorn-14173.exe	42
PID 1264 wrote to memory of 2000	1264	Unicorn-14173.exe	42
PID 1264 wrote to memory of 2000	1264	Unicorn-14173.exe	42
PID 2968 wrote to memory of 1976	2968	Unicorn-39907.exe	44
PID 2968 wrote to memory of 1976	2968	Unicorn-39907.exe	44
PID 2968 wrote to memory of 1976	2968	Unicorn-39907.exe	44
PID 2968 wrote to memory of 1976	2968	Unicorn-39907.exe	44
PID 2688 wrote to memory of 868	2688	Unicorn-21533.exe	43
PID 2688 wrote to memory of 868	2688	Unicorn-21533.exe	43
PID 2688 wrote to memory of 868	2688	Unicorn-21533.exe	43
PID 2688 wrote to memory of 868	2688	Unicorn-21533.exe	43
PID 2528 wrote to memory of 2792	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	45
PID 2528 wrote to memory of 2792	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	45
PID 2528 wrote to memory of 2792	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	45
PID 2528 wrote to memory of 2792	2528	09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe	45
PID 2572 wrote to memory of 2008	2572	Unicorn-43188.exe	46
PID 2572 wrote to memory of 2008	2572	Unicorn-43188.exe	46
PID 2572 wrote to memory of 2008	2572	Unicorn-43188.exe	46
PID 2572 wrote to memory of 2008	2572	Unicorn-43188.exe	46

C:\Users\Admin\AppData\Local\Temp\09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe
"C:\Users\Admin\AppData\Local\Temp\09cdc98b41e3deb0ff4ddc018fc1509c58fa5e78df5f37e9df5c9123c7a89f8aN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20552.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20552.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59218.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10567.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        9⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
        9⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe
        9⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        9⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47547.exe
        8⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        8⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
        8⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
        8⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        8⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27074.exe
        7⤵
        Executes dropped EXE
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        8⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7163.exe
        8⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
        8⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62481.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2694.exe
        7⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        7⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43436.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51792.exe
        7⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        8⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11624.exe
        8⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29133.exe
        6⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        7⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4399.exe
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        6⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65201.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        6⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33109.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51408.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe
        8⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
        9⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        9⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4340.exe
        8⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64122.exe
        7⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27271.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        7⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        7⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        7⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        7⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        6⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53088.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
        6⤵
        Executes dropped EXE
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        7⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        7⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13274.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        6⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
        7⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
        7⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50495.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        5⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13278.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45793.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        5⤵
        
        PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11262.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20111.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31533.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        7⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61714.exe
        6⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11028.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5341.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        6⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42664.exe
        6⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        7⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        7⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        7⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        7⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2477.exe
        6⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18075.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        6⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
        5⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        6⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53743.exe
        5⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31144.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55326.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        6⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        7⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        6⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
        6⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
        5⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36190.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62019.exe
        6⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        5⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45207.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45824.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21253.exe
        5⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        5⤵
        
        PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12322.exe
      4⤵
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
      4⤵
      PID:6400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18003.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        6⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21253.exe
        7⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50684.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15863.exe
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        5⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        6⤵
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40334.exe
        5⤵
        
        PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52498.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
        6⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47649.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
        7⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exe
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25067.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4153.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63128.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        6⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29106.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        5⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
      4⤵
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21370.exe
        5⤵
        
        PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
      4⤵
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33920.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36437.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33323.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46089.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        6⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        7⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4863.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        7⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64874.exe
        5⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        5⤵
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        5⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        5⤵
        
        PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
      4⤵
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
        5⤵
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6971.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42059.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56549.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2617.exe
      4⤵
      PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2768
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 244
        5⤵
        Program crash
        
        PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
      4⤵
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27029.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
      4⤵
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
      4⤵
      PID:6252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7059.exe
      4⤵
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21370.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64671.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exe
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25067.exe
      4⤵
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14266.exe
    3⤵
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
      4⤵
      PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      4⤵
      PID:6504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
    3⤵
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
    3⤵
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13063.exe
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
    3⤵
    PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
    3⤵
    PID:5924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14173.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14173.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16603.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
        7⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        7⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        6⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46183.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60238.exe
        7⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        6⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        6⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60328.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1022.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
        6⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        5⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
        5⤵
        
        PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51503.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        5⤵
        
        PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        6⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28337.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50684.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15548.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49008.exe
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28273.exe
        5⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7409.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        5⤵
        
        PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
      4⤵
      PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31144.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22383.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30967.exe
      4⤵
      PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
      4⤵
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30521.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27387.exe
        7⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54303.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9088.exe
        5⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51066.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9912.exe
      4⤵
      PID:788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-962.exe
        5⤵
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46750.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        5⤵
        
        PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
      4⤵
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
      4⤵
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
      4⤵
      PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5511.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63001.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        5⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64644.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        5⤵
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
      4⤵
      PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41673.exe
      4⤵
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30519.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
      4⤵
      PID:6204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-262.exe
    3⤵
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
      4⤵
      PID:5932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
    3⤵
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
    3⤵
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
    3⤵
    PID:5708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
      4⤵
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24653.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60633.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        5⤵
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5871.exe
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57241.exe
      4⤵
      PID:2256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50749.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        5⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exe
        5⤵
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exe
      4⤵
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
      4⤵
      PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      4⤵
      PID:6424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24653.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56549.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47849.exe
        5⤵
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
      4⤵
      PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
    3⤵
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8002.exe
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15505.exe
      4⤵
      PID:964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
    3⤵
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58424.exe
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36437.exe
    3⤵
    PID:5576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61719.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        5⤵
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        5⤵
        
        PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
      4⤵
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
      4⤵
      PID:6324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
      4⤵
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
        5⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56748.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28737.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
        5⤵
        
        PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16814.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
      4⤵
      PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39716.exe
      4⤵
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      4⤵
      PID:6480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59388.exe
    3⤵
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
      4⤵
      PID:5920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30407.exe
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58584.exe
    3⤵
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
    3⤵
    PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
    3⤵
    PID:6348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7672.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7672.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61989.exe
      4⤵
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
    3⤵
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35555.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
      4⤵
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56549.exe
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
      4⤵
      PID:6528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
    3⤵
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
    3⤵
    PID:6044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20239.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20239.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
    3⤵
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
      4⤵
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52615.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      4⤵
      PID:6408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29975.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48064.exe
    3⤵
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
    3⤵
    PID:5700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
    3⤵
    PID:6432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
  2⤵
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60832.exe
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42059.exe
    3⤵
    PID:4480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56549.exe
    3⤵
    PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20572.exe
    3⤵
    PID:6616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
  2⤵
  PID:784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57299.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57299.exe
  2⤵
  PID:4020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3802.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3802.exe
  2⤵
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
  2⤵
  PID:5632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18037.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18037.exe
  2⤵
  PID:6192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe

Filesize
468KB

MD5
ea5c2d2c4e94d557f6852b8cba79c349

SHA1
f0c8e81ab8320872d0160a80b67698c5345ae646

SHA256
fad264d20b39bf60c4db18b32063e88059667caeb361be5b02fd05b365fa9b33

SHA512
110afa987ef5b24a03d9ea296639ef566fa1633597ecc386ec833f99dea8085a3b5a35ac96c71d6ab4a5dda424e9a0e92b82a08258d2c4272a6a75893cd39dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe

Filesize
468KB

MD5
01c87faca15e621b0f95876627dd228a

SHA1
757ac5ac134b7a6c0aeab7476e9f84283a6bf9b9

SHA256
fffe9de85fdb6caa226bca53db99f61533c17dea06924c9a1882809687cb9696

SHA512
37fd0331688d3f60bd171cbbb5752fcff498f49a1ab2f85daf43d8002b6612a9b8ee9d123d904d98adec1c7b2108c6c31ff77281d38119d9ac633af112e980fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe

Filesize
468KB

MD5
b9f98cf185cda4706877ffd2cc726f04

SHA1
7486b02c1d97d270b1359e42237d311a20c22426

SHA256
99db638968135ae4193f3fd0e7c027578e1fcb057501abfce8023d6ccee0b7e7

SHA512
be3779ff9d399db7ec3178ef1d972678530e3df9497b88099cc98ac5dfd51082e6cfbca7c738a0f19ff735450ae5a6d270ed62ff465c7106f24c07d2723e8a28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe

Filesize
468KB

MD5
a2faa401d67c306c0b111e324b24caf4

SHA1
8cdde2351707162d11e19cd47188877c584a2982

SHA256
79664e41e7f86ce6e10467f76a32b9e88b756bfccacbac9498b41a0c15868ca9

SHA512
ffae3bc32b6dfd445be0e80b140219e7189d13b0b23733f7c4d0cb480f684c7134558fb18aec8c89515b88c671b6a76b08ed15ba52b9ed8f6806bf80ce07695a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11262.exe

Filesize
468KB

MD5
09bbd23ad6f1d99663e63cd33fc2bcda

SHA1
d8184f2e76fc4ee149a4e8ba7d69ac60c87ac239

SHA256
7883a324c0ec576e6749117f70836f3aaff25372f8b5945cc3f7925cda5d074d

SHA512
46f4fcec7c112a9b469674e7ec14ec5bcfd2776fe6f89c84b6c1ff9b400ad05393636422855db0f8d61bd5666e26fd846db919d2849190b9754dcdfce25049e5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14173.exe

Filesize
468KB

MD5
048d97754cd6f3ccf1f5928dc959ce32

SHA1
9bda4db7a92e30d4672a0a55e448683caa2be72d

SHA256
225ce7d0b8e4532e62dc659c3f4a4e64e95e0e840372ae4ff956403e3f4ef801

SHA512
647aa18428b206f93bde8aef1464e3a4bd12d81a8c7e84d6b396fe66e9046be8b2be7f74214cb411e04ce58fff761b6f5605e3f3ba993dc34976795204bcef9b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe

Filesize
468KB

MD5
5e6c0c6065434145464b77f3a3c7746f

SHA1
e54ff2c4f6f09f39744a09ca815de587381b90e7

SHA256
b205e6dd8822081334bb98ff436346533715870ef5ad5d9a76e0faedef8c9f1a

SHA512
24cd1651289cf74fc5f26ca22de94b78bc58c5d2b615c6ce1928f17676bd3466e524e814b6720569b96161e9301679c8182b2dd2b856300c4c194abcd0a722c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18003.exe

Filesize
468KB

MD5
b948a8d897a3bae0312b9ef3a030f7ce

SHA1
17733680dfcfcc00e8986b74059c93d72b7cf4f0

SHA256
e73ffbadb7eeb6ab61c2fab229be7c833d7401d99f2608774b608efc2f804a87

SHA512
545b25de2d7fd768c31a9158992ae70b080d0d339c2391d1ab90cfe6448545757a549534d60b348c922424ba1630c299fd263af11d985a85802c22ef4d2e00b0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20111.exe

Filesize
468KB

MD5
4f6673bd7f07b3166a22743a2ce44207

SHA1
f1827688a8ff7a73a5f993a02a9f0b612c8c630b

SHA256
4f132c26b67c27cc52d321f0f0491c8f45dc84e4126366f8194cb215b1b83517

SHA512
e7c8c3ff0be2360de91f16129965e1d5c0c85498500e1ebd56edfd3658ebd51be1e291a25f698b19e4f61b9a51a8e4c4b212a6c237f6f810887af0521bcb123d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20552.exe

Filesize
468KB

MD5
9e88fc8d9ea3ecb8b3157dedb2115cfa

SHA1
664899325e58c069b851616f2f8fe4836a9753bf

SHA256
02930fa6958fb69ebfbe99989e0e939468ac7db6b64fb940a1b0b0f821610a6d

SHA512
db64ba6b836166de69ad0d3cdd28edfbeff9a6fc15fd0918260d9f00115ddd5b405606d6803d6eb3d436a9fad1020bee201218a2fb598a7ad3e8e9cc87d7c4e8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe

Filesize
468KB

MD5
ed4a8208f4482c709e72a32539b20746

SHA1
a9e8332f8a8989cc41aa3f582d964bdddbbd50a7

SHA256
bc6e5b5e7331c41e56540959f335bff567e801ec579d38e76838f65b199c65c3

SHA512
ff38a9067be16f6887f3cc4a8ebd57615bceaa64840558be3bdb66124e5bdad48084f87034bb060ad2b409bf6ac954c0327690500b0e618516d649c59e0619e8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe

Filesize
468KB

MD5
2fa68b041852b05a807e330bf66364de

SHA1
3384c3f593c4418b009795d8eab48e19b1bfae51

SHA256
4939be9258572b427f7cbb167fc0d3de8c93567acda14fb4c99abec0776b4379

SHA512
0b59318c174e2c6ef45bc525c4242280e188c47be617dac42027ac5b437e1ae2badf26288fc43fc2d7a56821875cf0c98b8ab7131ecd49dad3ec220f25d6d249

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33109.exe

Filesize
468KB

MD5
34c745a965ecd9f8545b2bd4a5547701

SHA1
09590e3e088b7ae092893a8c7309f238554e0254

SHA256
0d45d0abe022c3a622bb16c730255fb13cf233c3d1d48bc23b2f5f1a5485b07b

SHA512
baebf3ac666b081168a2c787c455c49093bf71071426dea0503e87380f38626b83429988cc578e289c2d232152aa1452452b75d542d65c2cc82b7b0ee048e817

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe

Filesize
468KB

MD5
18abf45551dfd26edc681e9579168c64

SHA1
fa19988810249922fed22ab9df618812cae018f8

SHA256
1d5d6f789a650fb03abbd0555c1317979fb6fb2a32087fbb9d43c63bb23e3f65

SHA512
4ee7bdc730122650d1a869de50213a9cc8c4eeab600b9710e45043156e34ae1ff6fcd1637716895a4859278f0ee46b67a9ac35e09d93069e21dc478b961b9ba0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe

Filesize
468KB

MD5
ddefb575dc045c580a2cbde2c993644a

SHA1
81dd412e762459ba2e976e656be978ce530c52cf

SHA256
214c43da3c3b8d390d68c4cbd9d18d7bfaf25377c9c9271b38da264e7dab69c7

SHA512
ea3b24fd53df2a15afd30ddadfe338148fe9f8420cf455a9f407d42b2c055fea25323a4de9e3b4d62fedfe3b941d2d6354000df78359a8fc29497df0a757c596

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe

Filesize
468KB

MD5
444f55362247579b8b260dc7e4a20091

SHA1
686bb5f01167a22abacf13ee092d62de1acf805a

SHA256
530373e14277b2bfe5a6b318029713d579e24ddbeabbb53771caa8e3701c095e

SHA512
5bb40b2bab36dabda00e2f999534bef90ef15e1925d78709f4c180b0c8d4988d29e224714136ac368a299a7005091deb5cff70c962c6ef81758c8742a86bc4f8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe

Filesize
468KB

MD5
f5519465e2a70000dcb5bd5f358c2d1a

SHA1
32e0bafc09093bdc831590625d990376e769242b

SHA256
d8f7ef32fa2c0c40598761a1f1a655faba76e4826edf6244ee0c27ca3a3051b0

SHA512
25f4fc0ce62773351ecf58186aeb6e22d4d076ef543c6b2d2579487184054c3b3ed443531c63b4cf639eb74879c5a677e8c17b900ae5ec835a9e1a30103b55fe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe

Filesize
468KB

MD5
9ae90f991c28fdcec29511e4611f6057

SHA1
b8d8ac1e46b70a009686fe57294ddc85c5b3bd08

SHA256
6fd5a86d746521d27c7fe791c6e2fa004181668abc776587152c131f28d4fc62

SHA512
bc5e88b4960ffeb7bc27ace3d65045c8fa9277a77209a1ae7407413d2048a127858416a718e05fb7f09b1ca7ed18b01b6929b822698bd399e37bcedef726b957

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50654.exe

Filesize
468KB

MD5
5f66eed7d50ccab5c53a2ed91a29aa6c

SHA1
682adeb387ae5277e5e58df65608c0d9fbf12313

SHA256
915a9fa2dff3cb895987b9815158b26f21e77536bcf2d178610d50540eb6090b

SHA512
d65e4831442f51fcd8f2802f3fb8b89a5ef91e45b32803a4670fb09b8787c8f19f83c81e9486a2ea167da0e066435c3197de2d8148d280ab0bfef35a131eb9f4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe

Filesize
468KB

MD5
b46ec7558829ebf0310c8cb2410f864c

SHA1
5b79b8dddd1d75e23a75ba1a326bf69f5cdb9e4c

SHA256
399291a79179466c3540c36937d280cc594ce67cf9d9b8cc6d29165878091e12

SHA512
2d568f098b0c9463a4c95fa3d33f9daf9377965a4050af9c3026128ca7281d7d1959c1dcd35295658010d6ead8ca4aebf4ce454fb3dfcf79e06012ed74de6fbd

Download Submit