7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258

Analysis

max time kernel
118s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
Size

468KB
MD5

92e49753efff293fbbc0cfdce376fea0
SHA1

4c088351f902da1f36773ee1843e5899a6c33b92
SHA256

7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258
SHA512

539423b54fed66270ab91ecfeeed1cd38a211507b2325fe694c0771fe1912fbd50534759a53844484300a9ef6d6e9c7cffd893a821f2ce66261235959926e642
SSDEEP

3072:qG3logIf805UtbY3HzZOcf8/zChaP0ponLHewYParPULaW+TEslul:qGVoC8Ut4HlOcfuYJ8rPuV+TE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2132	Unicorn-24561.exe
2700	Unicorn-40621.exe
3040	Unicorn-40067.exe
2804	Unicorn-40150.exe
2892	Unicorn-62608.exe
2456	Unicorn-33928.exe
2772	Unicorn-1810.exe
2684	Unicorn-34011.exe
2060	Unicorn-40787.exe
1096	Unicorn-19621.exe
2512	Unicorn-37830.exe
1324	Unicorn-11452.exe
1228	Unicorn-14166.exe
1496	Unicorn-8036.exe
2516	Unicorn-59838.exe
1100	Unicorn-43331.exe
2472	Unicorn-52075.exe
2076	Unicorn-32209.exe
2384	Unicorn-36708.exe
2696	Unicorn-42838.exe
2312	Unicorn-12111.exe
2004	Unicorn-8582.exe
2160	Unicorn-31463.exe
912	Unicorn-44784.exe
2972	Unicorn-35853.exe
2480	Unicorn-6444.exe
2328	Unicorn-26310.exe
1780	Unicorn-16772.exe
3000	Unicorn-16506.exe
2188	Unicorn-27632.exe
2396	Unicorn-48266.exe
3044	Unicorn-52905.exe
1708	Unicorn-8914.exe
2200	Unicorn-11125.exe
2508	Unicorn-31546.exe
2716	Unicorn-4638.exe
2148	Unicorn-14394.exe
2740	Unicorn-26092.exe
2944	Unicorn-34814.exe
2616	Unicorn-54680.exe
2612	Unicorn-51151.exe
2628	Unicorn-28038.exe
2604	Unicorn-5479.exe
3068	Unicorn-32122.exe
1372	Unicorn-32021.exe
1592	Unicorn-18286.exe
1900	Unicorn-35244.exe
2348	Unicorn-19678.exe
1696	Unicorn-26454.exe
1528	Unicorn-36014.exe
1784	Unicorn-1203.exe
2068	Unicorn-49589.exe
608	Unicorn-3917.exe
2668	Unicorn-63324.exe
1952	Unicorn-31114.exe
448	Unicorn-20254.exe
1600	Unicorn-1779.exe
1588	Unicorn-23269.exe
1400	Unicorn-61186.exe
1448	Unicorn-63132.exe
1112	Unicorn-34758.exe
3012	Unicorn-62703.exe
2452	Unicorn-63258.exe
2980	Unicorn-17587.exe

Loads dropped DLL 64 IoCs

pid	Process
2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
2132	Unicorn-24561.exe
2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
2132	Unicorn-24561.exe
2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
2700	Unicorn-40621.exe
2700	Unicorn-40621.exe
2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
3040	Unicorn-40067.exe
3040	Unicorn-40067.exe
2132	Unicorn-24561.exe
2132	Unicorn-24561.exe
2804	Unicorn-40150.exe
2804	Unicorn-40150.exe
2700	Unicorn-40621.exe
2700	Unicorn-40621.exe
2892	Unicorn-62608.exe
2892	Unicorn-62608.exe
2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
2456	Unicorn-33928.exe
2456	Unicorn-33928.exe
2772	Unicorn-1810.exe
2772	Unicorn-1810.exe
3040	Unicorn-40067.exe
2132	Unicorn-24561.exe
3040	Unicorn-40067.exe
2132	Unicorn-24561.exe
2684	Unicorn-34011.exe
2684	Unicorn-34011.exe
2060	Unicorn-40787.exe
2804	Unicorn-40150.exe
2060	Unicorn-40787.exe
2804	Unicorn-40150.exe
3040	Unicorn-40067.exe
3040	Unicorn-40067.exe
2516	Unicorn-59838.exe
2516	Unicorn-59838.exe
1096	Unicorn-19621.exe
1096	Unicorn-19621.exe
2892	Unicorn-62608.exe
2892	Unicorn-62608.exe
2512	Unicorn-37830.exe
2512	Unicorn-37830.exe
2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
1324	Unicorn-11452.exe
2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
1324	Unicorn-11452.exe
1496	Unicorn-8036.exe
1496	Unicorn-8036.exe
2456	Unicorn-33928.exe
2456	Unicorn-33928.exe
2132	Unicorn-24561.exe
1228	Unicorn-14166.exe
1228	Unicorn-14166.exe
2132	Unicorn-24561.exe
2772	Unicorn-1810.exe
2772	Unicorn-1810.exe
1100	Unicorn-43331.exe
1100	Unicorn-43331.exe
2684	Unicorn-34011.exe
2684	Unicorn-34011.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2400	1384	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14166.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
2132	Unicorn-24561.exe
2700	Unicorn-40621.exe
3040	Unicorn-40067.exe
2804	Unicorn-40150.exe
2892	Unicorn-62608.exe
2456	Unicorn-33928.exe
2772	Unicorn-1810.exe
2684	Unicorn-34011.exe
2060	Unicorn-40787.exe
2512	Unicorn-37830.exe
1496	Unicorn-8036.exe
1228	Unicorn-14166.exe
1324	Unicorn-11452.exe
2516	Unicorn-59838.exe
1096	Unicorn-19621.exe
1100	Unicorn-43331.exe
2472	Unicorn-52075.exe
2076	Unicorn-32209.exe
2384	Unicorn-36708.exe
2696	Unicorn-42838.exe
2312	Unicorn-12111.exe
2004	Unicorn-8582.exe
2160	Unicorn-31463.exe
912	Unicorn-44784.exe
2972	Unicorn-35853.exe
2480	Unicorn-6444.exe
2328	Unicorn-26310.exe
1780	Unicorn-16772.exe
3000	Unicorn-16506.exe
2188	Unicorn-27632.exe
2396	Unicorn-48266.exe
3044	Unicorn-52905.exe
1708	Unicorn-8914.exe
2200	Unicorn-11125.exe
2716	Unicorn-4638.exe
2508	Unicorn-31546.exe
2148	Unicorn-14394.exe
2740	Unicorn-26092.exe
2616	Unicorn-54680.exe
2944	Unicorn-34814.exe
2612	Unicorn-51151.exe
2628	Unicorn-28038.exe
2604	Unicorn-5479.exe
3068	Unicorn-32122.exe
1592	Unicorn-18286.exe
1372	Unicorn-32021.exe
1900	Unicorn-35244.exe
2348	Unicorn-19678.exe
1696	Unicorn-26454.exe
1528	Unicorn-36014.exe
1784	Unicorn-1203.exe
608	Unicorn-3917.exe
1952	Unicorn-31114.exe
2668	Unicorn-63324.exe
2068	Unicorn-49589.exe
448	Unicorn-20254.exe
1600	Unicorn-1779.exe
1400	Unicorn-61186.exe
1588	Unicorn-23269.exe
1112	Unicorn-34758.exe
1448	Unicorn-63132.exe
3012	Unicorn-62703.exe
2452	Unicorn-63258.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2132	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	30
PID 2232 wrote to memory of 2132	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	30
PID 2232 wrote to memory of 2132	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	30
PID 2232 wrote to memory of 2132	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	30
PID 2132 wrote to memory of 3040	2132	Unicorn-24561.exe	32
PID 2132 wrote to memory of 3040	2132	Unicorn-24561.exe	32
PID 2132 wrote to memory of 3040	2132	Unicorn-24561.exe	32
PID 2132 wrote to memory of 3040	2132	Unicorn-24561.exe	32
PID 2232 wrote to memory of 2700	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	33
PID 2232 wrote to memory of 2700	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	33
PID 2232 wrote to memory of 2700	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	33
PID 2232 wrote to memory of 2700	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	33
PID 2700 wrote to memory of 2804	2700	Unicorn-40621.exe	34
PID 2700 wrote to memory of 2804	2700	Unicorn-40621.exe	34
PID 2700 wrote to memory of 2804	2700	Unicorn-40621.exe	34
PID 2700 wrote to memory of 2804	2700	Unicorn-40621.exe	34
PID 2232 wrote to memory of 2892	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	35
PID 2232 wrote to memory of 2892	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	35
PID 2232 wrote to memory of 2892	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	35
PID 2232 wrote to memory of 2892	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	35
PID 3040 wrote to memory of 2456	3040	Unicorn-40067.exe	36
PID 3040 wrote to memory of 2456	3040	Unicorn-40067.exe	36
PID 3040 wrote to memory of 2456	3040	Unicorn-40067.exe	36
PID 3040 wrote to memory of 2456	3040	Unicorn-40067.exe	36
PID 2132 wrote to memory of 2772	2132	Unicorn-24561.exe	37
PID 2132 wrote to memory of 2772	2132	Unicorn-24561.exe	37
PID 2132 wrote to memory of 2772	2132	Unicorn-24561.exe	37
PID 2132 wrote to memory of 2772	2132	Unicorn-24561.exe	37
PID 2804 wrote to memory of 2684	2804	Unicorn-40150.exe	38
PID 2804 wrote to memory of 2684	2804	Unicorn-40150.exe	38
PID 2804 wrote to memory of 2684	2804	Unicorn-40150.exe	38
PID 2804 wrote to memory of 2684	2804	Unicorn-40150.exe	38
PID 2700 wrote to memory of 2060	2700	Unicorn-40621.exe	39
PID 2700 wrote to memory of 2060	2700	Unicorn-40621.exe	39
PID 2700 wrote to memory of 2060	2700	Unicorn-40621.exe	39
PID 2700 wrote to memory of 2060	2700	Unicorn-40621.exe	39
PID 2892 wrote to memory of 1096	2892	Unicorn-62608.exe	40
PID 2892 wrote to memory of 1096	2892	Unicorn-62608.exe	40
PID 2892 wrote to memory of 1096	2892	Unicorn-62608.exe	40
PID 2892 wrote to memory of 1096	2892	Unicorn-62608.exe	40
PID 2232 wrote to memory of 2512	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	41
PID 2232 wrote to memory of 2512	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	41
PID 2232 wrote to memory of 2512	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	41
PID 2232 wrote to memory of 2512	2232	7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe	41
PID 2456 wrote to memory of 1324	2456	Unicorn-33928.exe	42
PID 2456 wrote to memory of 1324	2456	Unicorn-33928.exe	42
PID 2456 wrote to memory of 1324	2456	Unicorn-33928.exe	42
PID 2456 wrote to memory of 1324	2456	Unicorn-33928.exe	42
PID 2772 wrote to memory of 1228	2772	Unicorn-1810.exe	43
PID 2772 wrote to memory of 1228	2772	Unicorn-1810.exe	43
PID 2772 wrote to memory of 1228	2772	Unicorn-1810.exe	43
PID 2772 wrote to memory of 1228	2772	Unicorn-1810.exe	43
PID 3040 wrote to memory of 2516	3040	Unicorn-40067.exe	44
PID 3040 wrote to memory of 2516	3040	Unicorn-40067.exe	44
PID 3040 wrote to memory of 2516	3040	Unicorn-40067.exe	44
PID 3040 wrote to memory of 2516	3040	Unicorn-40067.exe	44
PID 2132 wrote to memory of 1496	2132	Unicorn-24561.exe	45
PID 2132 wrote to memory of 1496	2132	Unicorn-24561.exe	45
PID 2132 wrote to memory of 1496	2132	Unicorn-24561.exe	45
PID 2132 wrote to memory of 1496	2132	Unicorn-24561.exe	45
PID 2684 wrote to memory of 1100	2684	Unicorn-34011.exe	46
PID 2684 wrote to memory of 1100	2684	Unicorn-34011.exe	46
PID 2684 wrote to memory of 1100	2684	Unicorn-34011.exe	46
PID 2684 wrote to memory of 1100	2684	Unicorn-34011.exe	46

C:\Users\Admin\AppData\Local\Temp\7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe
"C:\Users\Admin\AppData\Local\Temp\7fb34ca15b7ef90de829a69f41a69437ce44b0bc79b956f5729aa179c87f6258N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40067.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33928.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44784.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26092.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20301.exe
        8⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        9⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        9⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        9⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53860.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
        8⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        8⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        8⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        7⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe
        8⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42631.exe
        9⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36400.exe
        9⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
        9⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        8⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
        7⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15339.exe
        7⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11273.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11556.exe
        7⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        8⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        8⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26916.exe
        7⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        7⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
        6⤵
        
        PID:284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
        7⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11239.exe
        6⤵
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        6⤵
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6444.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
        7⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        8⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        7⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        6⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24943.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11273.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63324.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20868.exe
        7⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        5⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31312.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        7⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        8⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
        8⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        8⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6299.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exe
        7⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10357.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        7⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        7⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
        6⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        6⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
        7⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        7⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        6⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29922.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26339.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
        5⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        5⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        6⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        5⤵
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36708.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11125.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
        6⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        7⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        7⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10881.exe
        6⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        6⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
        5⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52921.exe
        6⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29139.exe
        6⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30262.exe
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11273.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22055.exe
        5⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31754.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
        6⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
        5⤵
        
        PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
      4⤵
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        5⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33209.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
      4⤵
      PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
      4⤵
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23865.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
      4⤵
      PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14166.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19678.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        8⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        8⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        7⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        6⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        7⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24424.exe
        6⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26454.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        6⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        6⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        6⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        5⤵
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22056.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
        5⤵
        
        PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1779.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        6⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12267.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51857.exe
        5⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-273.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35777.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        5⤵
        
        PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        5⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
      4⤵
      PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52783.exe
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
      4⤵
      PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8036.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26310.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1203.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        6⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17447.exe
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        7⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36501.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        5⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        5⤵
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49589.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        6⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        6⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25977.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35816.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54300.exe
      4⤵
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
      4⤵
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
      4⤵
      PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51214.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54483.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36501.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35005.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exe
        5⤵
        
        PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54187.exe
      4⤵
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        5⤵
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
      4⤵
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
      4⤵
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34758.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45080.exe
      4⤵
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        5⤵
        
        PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15152.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34666.exe
        5⤵
        
        PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
      4⤵
      PID:6408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40034.exe
    3⤵
    PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
      4⤵
      PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
      4⤵
      PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8424.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
    3⤵
    PID:5024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36399.exe
    3⤵
    PID:5452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42314.exe
        8⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19511.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        8⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        7⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        7⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63258.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        8⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exe
        8⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27212.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64679.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10479.exe
        7⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46791.exe
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41306.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        6⤵
        
        PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        6⤵
        Executes dropped EXE
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
        7⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        7⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49584.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61259.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        6⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        5⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
        6⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5479.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2402.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        7⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47976.exe
        8⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe
        8⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        8⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8551.exe
        6⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
        7⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        5⤵
        
        PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59754.exe
        5⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        6⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12713.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10445.exe
        5⤵
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38583.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12895.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22765.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41392.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20137.exe
        6⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        5⤵
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
      4⤵
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        5⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        6⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5389.exe
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
      4⤵
      PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32199.exe
      4⤵
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40787.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52075.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54680.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        6⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        5⤵
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26907.exe
        5⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exe
        6⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        5⤵
        
        PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
      4⤵
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42314.exe
        5⤵
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
      4⤵
      PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
      4⤵
      PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8914.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
      4⤵
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35816.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
      4⤵
      PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
      4⤵
      PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8464.exe
    3⤵
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
      4⤵
      PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
      4⤵
      PID:6344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
    3⤵
    PID:2884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45367.exe
    3⤵
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14083.exe
    3⤵
    PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1473.exe
    3⤵
    PID:6236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19621.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29045.exe
        6⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 236
        7⤵
        Program crash
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10479.exe
        6⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48074.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35921.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        6⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53252.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47664.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
        5⤵
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11273.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18286.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        5⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48190.exe
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9827.exe
        5⤵
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
      4⤵
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16413.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
      4⤵
      PID:5596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20254.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
        5⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
      4⤵
      PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
      4⤵
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
      4⤵
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
      4⤵
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
      4⤵
      PID:6152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45474.exe
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
    3⤵
    PID:5940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
    3⤵
    PID:5456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37830.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37830.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31463.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exe
        5⤵
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18489.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54412.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19179.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35816.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44905.exe
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54187.exe
      4⤵
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        6⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19077.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        5⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
        5⤵
        
        PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
      4⤵
      PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63149.exe
      4⤵
      PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31114.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33980.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27808.exe
      4⤵
      PID:6392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
      4⤵
      PID:5928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
    3⤵
    PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
    3⤵
    PID:5920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7472.exe
      4⤵
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7695.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
      4⤵
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35777.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
    3⤵
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58183.exe
      4⤵
      PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
      4⤵
      PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
    3⤵
    PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
    3⤵
    PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
    3⤵
    PID:5584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36912.exe
    3⤵
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
      4⤵
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45943.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
      4⤵
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16636.exe
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
    3⤵
    PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
    3⤵
    PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
    3⤵
    PID:4808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
  2⤵
  PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
    3⤵
    PID:2344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
    3⤵
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exe
  2⤵
  PID:3248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
  2⤵
  PID:4352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47182.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47182.exe
  2⤵
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8663.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8663.exe
  2⤵
  PID:5432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe

Filesize
468KB

MD5
c05c4bd4e4ab831d7a46066fc77928ec

SHA1
77ae808750acdfa894b57dfa97f6a3ea7ea2d8a3

SHA256
4cc934655c70623c507da853e87233f89fdd86c44b342d8007984d82cf75262d

SHA512
cb1e982045da729d7591fb1e4657d647a7b0f8573212f1842e9cd50f501a8ad0bdf7a194c307f5b5ee93a971e251a60617987ddda27c82c96f67b016040361c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14166.exe

Filesize
468KB

MD5
98884819a258f04520c7d09f0ee5c2fc

SHA1
34f5446101647f104bb7120ecff00d4e90f091eb

SHA256
5f8c4afb5fb64ab2cfd4b47184ab4b2f7649eb27fd66783f4b52a76ab6b78be6

SHA512
72bbf51b5574523e0cf694ba20225e0e22e119c86338466658639013eacc1e811921862abe194604a2c9a9994314943b659a8b254822a3f974b1c10a089c6a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe

Filesize
468KB

MD5
f1bdb8d9423892055539ea23beb50572

SHA1
fd2ec4b50d99adca5ec8217d5411049f9349edc6

SHA256
379e01ab682195f197a851f1354accd1c91dc505b2e97368a77e710104e6c375

SHA512
44214795cadc137c3a70951029e4cf52f82e44bcb9aef24eafdb4856e5ddb60e54f8f6b211f9db3d53dd12229886c787696fe6f2363ad7aeb5df84a644e9f9a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37830.exe

Filesize
468KB

MD5
0923119dc760282961017933d00f3d58

SHA1
c6359be551a659147808ba8ea298c06319a326d4

SHA256
2a3ba9f1fbb6d82363bfb9032e1484f3b48b153c3bbafee18ec1f8f6a069de10

SHA512
9908e70e0218259e9963fa31e27b21a4c282c9322c704d27d3f6e55cd389a4a221b3dcb49d92260178f0543dafc085196d3fc2e33a42676c335b42a2ab1cb911

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe

Filesize
468KB

MD5
98e00162ff79588b2c904304e3dd10ed

SHA1
2d2478dc830f830871eafd741c36c1a187b83104

SHA256
42f0d41fc611f289d55b10e8a41fdd356ae6e08681a1b6098f1eecc3fbe246be

SHA512
690745aab4cc4667e09c9d97ab9a4ad338da425b4a23298b9bb0061d700bdfca3e4b2b991b598669ad4e265eb3568bb0a24ea4163c2f54d1332c6cab044c4417

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe

Filesize
468KB

MD5
75b0e17d47b52fdb1772a5e3e251feff

SHA1
337d6f108fc18ffe37d68a948bde6436b70eec8f

SHA256
c93cd55196a913b784f2c0837603f0fcfabb05a2019b581223713f5505127ba4

SHA512
f9bd4ac10b0415f319535bd8b7159f3fa6a6f8a61d9ed84afe4ed110ac07d9e401dcf52f051b3fefd370faff8c716aa88ac06abfa1e5345dc73d8cf368452716

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40787.exe

Filesize
468KB

MD5
aa281780004e04a5c98aff2d9c703689

SHA1
8d76927c01726debe1938dd4bdaf8ad6bc03144d

SHA256
0419e51c4e161cb82b8acee99c86a1745982a5d219c9c88d0e358b42d68d0d29

SHA512
e88d08cc996abf16996689e1452b4864380cc64ad9155bfbd7f44b236b469f35a3970f4f969abdd273c411ddddbd8ac646bba3d4036eaf4fc635fee077de18d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe

Filesize
468KB

MD5
b9b68ee5bb1fa45ce8fe5434cfdcb596

SHA1
3c4ee98a61a966e7fa89aac9340c4a153625ce8f

SHA256
d81b362b5c5b5c0cb0d3e742ef4ee04b284e59a1eeaef51aad8a688f64a155de

SHA512
25820b47cfa345cf22ad8e7d0274a442fa839a5f9cf311f3e8930219ca772c4a37aad4752cf7c5d435563938749dde1eca52b918ae923a95b76101531fea4bdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe

Filesize
468KB

MD5
f760339f04e40b03d1f5ff8177183d20

SHA1
22dfd6a13781189a4927e2b6f705cb5cd44c2706

SHA256
ca1f7717c2dfa5cc95b9447dd81070deca618ea6accebd503f1ef3bddbcd0011

SHA512
2ae5a3bae3a290b26862159f07767ea190c50a9fb4943787f9a0ac8bcefce62fa067b96b6d25ffc1c8cfc5e02e802939b0c23eb9d40c0e091ec0a69bd987cdd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe

Filesize
468KB

MD5
73c212f3436001ba60e68d5f3741ed95

SHA1
f526da063df0fa1792b1bac5a10c23b5aa495109

SHA256
3385edffedbd9dd2ea92882683e7926ed9c26d7189f3ed2a0f2b1cad7123ed83

SHA512
f797886f535e8bd432b2667e125b2d4a5a651d9d3ffe1233aff6384993cb1f8a63e112833207e7f0c063ab385c01e7702f369ac3343dfc18b48ca15c11437439

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8036.exe

Filesize
468KB

MD5
8438f9edb72bafdb1077f100b8ba5e99

SHA1
a40a206dcf1fd3b3f6765db9f34df9eb4af9d899

SHA256
e27c0c42a6084cda09c98d0dfd20ff5269ee963470e37ed8c8cd039cf31d1290

SHA512
02cd8a4bd2242ff587afa57b54a62aa8d11c5a707a13351baaa2aa0ded62679651b0689bcf05724cb9af95050cd9dda1ee4950ac311f7002bfc976820b96999d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe

Filesize
468KB

MD5
382cd31d0eb499921e45364d792b5a69

SHA1
6b4d4b32f7e70eb11838e6410a2860804afd1e48

SHA256
4cdb68c71213a7c9c8a4905972133ead57f1656165642d9e796f5fbaa647d5d3

SHA512
05d66d722329f00bc95bd6daa6afb619748192b63fdc046b088e6bf9e0ed444520cc11b22450f66498ec64f3ce6cd15590b62bfdc89c9bb9a4939dd404100dee

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19621.exe

Filesize
468KB

MD5
ca887cd1ac4e8f8ca46aafa5c09f0a77

SHA1
9b4b2d87b83feabf1cba83d18dcc65ba3a300a79

SHA256
3f321cc9da815636936154e6efa57702bb31e13804946e098f97791a5a152b4f

SHA512
801c99cbfcb67ceb50834a9abdc68a93f1afe2c9aedc45d14b46fe2d786f90ae68098d8b57eb451ab4ccbda339529ab3ca5dfed9e0f7596f9811cdd3fe087121

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe

Filesize
468KB

MD5
f09a363dfa0d0d68cec128a227101fc6

SHA1
24208e46de08c2d6f50508cd9c2fb44f92e39442

SHA256
a8b293e23f740cc4bea454e476c8bb005641d5aacf015befe7397ff2e8afd004

SHA512
5956b0af97137c5db1a4ad721f8bcc6ca12a72c23517989b10e8638d738ebb572e2615629b6cd2b6e971dfd4bca6a36f0c2122cd6bf926290668f15cc8dd5516

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33928.exe

Filesize
468KB

MD5
99bbb3eeef00714c8194f0edf76cabb7

SHA1
34378930a0ef7f389b4274a301eb81018509f772

SHA256
c035c5f512a98cd207ec910ccd718fa6cedb01aa2a008e80327590dd3fe62bdd

SHA512
c4b834c519a01aec2adacb499ee533cd6eca266a64f733a03bc1bfe604fc18bd3382bfc495c026ab97553737886685b22ae34785c363ba6d18ac57fa45b51183

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe

Filesize
468KB

MD5
8c198070b739bfc5a62ad6602a0dfa87

SHA1
63e4af510bd6b2ae1d84a692b76062249e065337

SHA256
89f484e7910199b2464c3556017fe9332a611427ad09ee83c853f59f2451ca9e

SHA512
edf10d1ca62d71dd41dac0f2130c3596fb3b5c3bef229b6315ba3ba77f4e23ed656ad9b292405e3d92ba1ff16669627293ab195bbe6550a85a5d0e1237777f92

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40067.exe

Filesize
468KB

MD5
b6be726b940075225ca14b4d13305be9

SHA1
6edf0ce0332956112fe3321cbd029a19937f6f29

SHA256
39257895c630c7d70bca3c1c0e601abb0f34a0d1446dfc224b10cc7b0a18ab87

SHA512
9dfd02b2b817bcd080e2c7d231fdd3e8bfcd8458f294e7b625801dbd6354cdd30fcfd06c6fbd5ac205a51e6acc97c84cef6edb58a3eb6b250022a836e41e6234

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe

Filesize
468KB

MD5
9af2461615d4990fced823d20b8e5692

SHA1
84c04d06cff86f95139bb9338be3a72343f5a8f2

SHA256
7d2470755c9bcd318abf8040e58230ff49765a35fe25c3c86635da42ae155934

SHA512
f59b3df504d4a59768921a5aa766410e7bf8bba9c7ea2874022292de68edaabb5854d2a24fc3fd91a9a12d7754606131a366029f449c81e433430b6fc8f83060

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe

Filesize
468KB

MD5
8705aff935197351da8b3d18e5621b5a

SHA1
29e52a194451a74d07e415e428e22616d67861b6

SHA256
f1d094b7bcbd7999069be93a2a62e0fcbbef8e98eaa155defa838a192e1c3f5a

SHA512
edb7386ab1f9c023b628e1c6bb7eab7093ea2eca1e8fb3c5a15c6dbc8b3f34803b3333fc6b9d62626f259bea2ea8a5993d6788bd98bf6d7091dd00e7893f78eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52075.exe

Filesize
468KB

MD5
a12659a9dd531e98591f060622de4fd3

SHA1
c48d9292fdd9b5f50becd626899995e4ef97767e

SHA256
809630f8933feff7b42cf852a825cd1faa1aa2bbd09b31a0c87ef27d22ba81ce

SHA512
8ccb049ca6393f08ff7c8364511ae318a3870ea606daf0f2739c19aafeecb0c0ecbef14caf9c7458e985b00a36058184861f0da8bcfaed63e4e589888f88ea17

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe

Filesize
468KB

MD5
56300b7d8d58ad9b2786714235537d14

SHA1
538eec27e699915ae5becbf2b830ac381f89a468

SHA256
7c70c7c34df02fb8b345f3f469901e88a294621a21445c56fec90f9cc757eb16

SHA512
ac38806ef13dd17d5f9de6f9b58543580838fc5615e507e64ded3321a4dadcec1a7b72a078819574cf620b90063656fce25fa0cd3ca4b7a8435c8c90afa32a37

Download Submit