a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3d

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
Size

468KB
MD5

2b14c6f43f4c3c0026952b420803e5a0
SHA1

d2420178c003bd5b477e124c4d0f1cd77fa8fea0
SHA256

a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3d
SHA512

4a9ea6f1b8b707223629b92a8150a149fe3d22f753426d252c7888e1c3766ca0bb5c6ef48c42c54cc6f67e82b13280328bbac6a7161cf0a090d7e8b6426f15c5
SSDEEP

3072:ebbCogIdj05U4AYJP0bjff8/ECYFXIpCnmHexVp+0oq3ANPVRwlq:ebuor8U4fPyjffL0oo0oogPVR

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2680	Unicorn-3578.exe
2564	Unicorn-41295.exe
2836	Unicorn-29597.exe
2560	Unicorn-19012.exe
1628	Unicorn-29702.exe
2956	Unicorn-9836.exe
796	Unicorn-31739.exe
2892	Unicorn-58529.exe
3024	Unicorn-32633.exe
572	Unicorn-39863.exe
2828	Unicorn-7190.exe
576	Unicorn-1060.exe
2496	Unicorn-6375.exe
2188	Unicorn-25976.exe
236	Unicorn-26241.exe
2208	Unicorn-36931.exe
1272	Unicorn-34884.exe
1132	Unicorn-10288.exe
2024	Unicorn-43214.exe
1164	Unicorn-52966.exe
748	Unicorn-65218.exe
2352	Unicorn-4704.exe
852	Unicorn-39514.exe
1804	Unicorn-10371.exe
840	Unicorn-10179.exe
1924	Unicorn-10179.exe
1464	Unicorn-1249.exe
1152	Unicorn-4049.exe
2424	Unicorn-9914.exe
1084	Unicorn-10734.exe
928	Unicorn-41866.exe
1604	Unicorn-50397.exe
2164	Unicorn-23200.exe
860	Unicorn-23200.exe
1612	Unicorn-1772.exe
1620	Unicorn-33890.exe
2692	Unicorn-25813.exe
2980	Unicorn-27860.exe
1748	Unicorn-38528.exe
2596	Unicorn-60018.exe
1508	Unicorn-30994.exe
2592	Unicorn-29313.exe
2080	Unicorn-25783.exe
624	Unicorn-39519.exe
1736	Unicorn-53625.exe
1708	Unicorn-38970.exe
1304	Unicorn-43319.exe
1440	Unicorn-43319.exe
2248	Unicorn-41373.exe
1068	Unicorn-35243.exe
2464	Unicorn-48150.exe
1208	Unicorn-2478.exe
1460	Unicorn-19991.exe
2224	Unicorn-45457.exe
1968	Unicorn-7693.exe
332	Unicorn-29596.exe
2220	Unicorn-35727.exe
2300	Unicorn-34964.exe
868	Unicorn-15306.exe
1988	Unicorn-11585.exe
1836	Unicorn-4808.exe
1048	Unicorn-45933.exe
1544	Unicorn-58669.exe
2404	Unicorn-16245.exe

Loads dropped DLL 64 IoCs

pid	Process
2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
2680	Unicorn-3578.exe
2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
2680	Unicorn-3578.exe
2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
2564	Unicorn-41295.exe
2564	Unicorn-41295.exe
2836	Unicorn-29597.exe
2836	Unicorn-29597.exe
2680	Unicorn-3578.exe
2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
2680	Unicorn-3578.exe
2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
2560	Unicorn-19012.exe
2560	Unicorn-19012.exe
2564	Unicorn-41295.exe
2564	Unicorn-41295.exe
2956	Unicorn-9836.exe
2956	Unicorn-9836.exe
2680	Unicorn-3578.exe
2680	Unicorn-3578.exe
1628	Unicorn-29702.exe
1628	Unicorn-29702.exe
2836	Unicorn-29597.exe
2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
796	Unicorn-31739.exe
2836	Unicorn-29597.exe
2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
796	Unicorn-31739.exe
3024	Unicorn-32633.exe
2564	Unicorn-41295.exe
3024	Unicorn-32633.exe
2564	Unicorn-41295.exe
2892	Unicorn-58529.exe
2892	Unicorn-58529.exe
2560	Unicorn-19012.exe
2560	Unicorn-19012.exe
2828	Unicorn-7190.exe
2828	Unicorn-7190.exe
572	Unicorn-39863.exe
572	Unicorn-39863.exe
1628	Unicorn-29702.exe
1628	Unicorn-29702.exe
2956	Unicorn-9836.exe
2956	Unicorn-9836.exe
2188	Unicorn-25976.exe
2188	Unicorn-25976.exe
576	Unicorn-1060.exe
2496	Unicorn-6375.exe
2836	Unicorn-29597.exe
2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
2680	Unicorn-3578.exe
576	Unicorn-1060.exe
2836	Unicorn-29597.exe
2496	Unicorn-6375.exe
2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
2680	Unicorn-3578.exe
796	Unicorn-31739.exe
796	Unicorn-31739.exe
2208	Unicorn-36931.exe
2208	Unicorn-36931.exe
3024	Unicorn-32633.exe
3024	Unicorn-32633.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1644	1068	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1108.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
2680	Unicorn-3578.exe
2564	Unicorn-41295.exe
2836	Unicorn-29597.exe
2560	Unicorn-19012.exe
1628	Unicorn-29702.exe
2956	Unicorn-9836.exe
796	Unicorn-31739.exe
3024	Unicorn-32633.exe
2892	Unicorn-58529.exe
2828	Unicorn-7190.exe
572	Unicorn-39863.exe
2188	Unicorn-25976.exe
576	Unicorn-1060.exe
2496	Unicorn-6375.exe
236	Unicorn-26241.exe
2208	Unicorn-36931.exe
2024	Unicorn-43214.exe
1132	Unicorn-10288.exe
1272	Unicorn-34884.exe
1164	Unicorn-52966.exe
748	Unicorn-65218.exe
2352	Unicorn-4704.exe
1804	Unicorn-10371.exe
2424	Unicorn-9914.exe
852	Unicorn-39514.exe
840	Unicorn-10179.exe
1464	Unicorn-1249.exe
1084	Unicorn-10734.exe
1924	Unicorn-10179.exe
1152	Unicorn-4049.exe
928	Unicorn-41866.exe
1604	Unicorn-50397.exe
2164	Unicorn-23200.exe
860	Unicorn-23200.exe
1612	Unicorn-1772.exe
1620	Unicorn-33890.exe
2692	Unicorn-25813.exe
2980	Unicorn-27860.exe
1748	Unicorn-38528.exe
1508	Unicorn-30994.exe
2596	Unicorn-60018.exe
2592	Unicorn-29313.exe
1440	Unicorn-43319.exe
1304	Unicorn-43319.exe
1068	Unicorn-35243.exe
1208	Unicorn-2478.exe
1708	Unicorn-38970.exe
2464	Unicorn-48150.exe
2080	Unicorn-25783.exe
2248	Unicorn-41373.exe
1736	Unicorn-53625.exe
1460	Unicorn-19991.exe
2224	Unicorn-45457.exe
624	Unicorn-39519.exe
332	Unicorn-29596.exe
2300	Unicorn-34964.exe
868	Unicorn-15306.exe
1988	Unicorn-11585.exe
1968	Unicorn-7693.exe
1836	Unicorn-4808.exe
2220	Unicorn-35727.exe
1048	Unicorn-45933.exe
1544	Unicorn-58669.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2680	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	30
PID 2772 wrote to memory of 2680	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	30
PID 2772 wrote to memory of 2680	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	30
PID 2772 wrote to memory of 2680	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	30
PID 2680 wrote to memory of 2564	2680	Unicorn-3578.exe	31
PID 2680 wrote to memory of 2564	2680	Unicorn-3578.exe	31
PID 2680 wrote to memory of 2564	2680	Unicorn-3578.exe	31
PID 2680 wrote to memory of 2564	2680	Unicorn-3578.exe	31
PID 2772 wrote to memory of 2836	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	32
PID 2772 wrote to memory of 2836	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	32
PID 2772 wrote to memory of 2836	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	32
PID 2772 wrote to memory of 2836	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	32
PID 2564 wrote to memory of 2560	2564	Unicorn-41295.exe	33
PID 2564 wrote to memory of 2560	2564	Unicorn-41295.exe	33
PID 2564 wrote to memory of 2560	2564	Unicorn-41295.exe	33
PID 2564 wrote to memory of 2560	2564	Unicorn-41295.exe	33
PID 2836 wrote to memory of 1628	2836	Unicorn-29597.exe	34
PID 2836 wrote to memory of 1628	2836	Unicorn-29597.exe	34
PID 2836 wrote to memory of 1628	2836	Unicorn-29597.exe	34
PID 2836 wrote to memory of 1628	2836	Unicorn-29597.exe	34
PID 2680 wrote to memory of 2956	2680	Unicorn-3578.exe	36
PID 2680 wrote to memory of 2956	2680	Unicorn-3578.exe	36
PID 2680 wrote to memory of 2956	2680	Unicorn-3578.exe	36
PID 2680 wrote to memory of 2956	2680	Unicorn-3578.exe	36
PID 2772 wrote to memory of 796	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	35
PID 2772 wrote to memory of 796	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	35
PID 2772 wrote to memory of 796	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	35
PID 2772 wrote to memory of 796	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	35
PID 2560 wrote to memory of 2892	2560	Unicorn-19012.exe	37
PID 2560 wrote to memory of 2892	2560	Unicorn-19012.exe	37
PID 2560 wrote to memory of 2892	2560	Unicorn-19012.exe	37
PID 2560 wrote to memory of 2892	2560	Unicorn-19012.exe	37
PID 2564 wrote to memory of 3024	2564	Unicorn-41295.exe	38
PID 2564 wrote to memory of 3024	2564	Unicorn-41295.exe	38
PID 2564 wrote to memory of 3024	2564	Unicorn-41295.exe	38
PID 2564 wrote to memory of 3024	2564	Unicorn-41295.exe	38
PID 2956 wrote to memory of 572	2956	Unicorn-9836.exe	39
PID 2956 wrote to memory of 572	2956	Unicorn-9836.exe	39
PID 2956 wrote to memory of 572	2956	Unicorn-9836.exe	39
PID 2956 wrote to memory of 572	2956	Unicorn-9836.exe	39
PID 2680 wrote to memory of 576	2680	Unicorn-3578.exe	40
PID 2680 wrote to memory of 576	2680	Unicorn-3578.exe	40
PID 2680 wrote to memory of 576	2680	Unicorn-3578.exe	40
PID 2680 wrote to memory of 576	2680	Unicorn-3578.exe	40
PID 1628 wrote to memory of 2828	1628	Unicorn-29702.exe	41
PID 1628 wrote to memory of 2828	1628	Unicorn-29702.exe	41
PID 1628 wrote to memory of 2828	1628	Unicorn-29702.exe	41
PID 1628 wrote to memory of 2828	1628	Unicorn-29702.exe	41
PID 2836 wrote to memory of 2496	2836	Unicorn-29597.exe	42
PID 2836 wrote to memory of 2496	2836	Unicorn-29597.exe	42
PID 2836 wrote to memory of 2496	2836	Unicorn-29597.exe	42
PID 2836 wrote to memory of 2496	2836	Unicorn-29597.exe	42
PID 2772 wrote to memory of 2188	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	43
PID 2772 wrote to memory of 2188	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	43
PID 2772 wrote to memory of 2188	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	43
PID 2772 wrote to memory of 2188	2772	a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe	43
PID 796 wrote to memory of 236	796	Unicorn-31739.exe	44
PID 796 wrote to memory of 236	796	Unicorn-31739.exe	44
PID 796 wrote to memory of 236	796	Unicorn-31739.exe	44
PID 796 wrote to memory of 236	796	Unicorn-31739.exe	44
PID 3024 wrote to memory of 2208	3024	Unicorn-32633.exe	45
PID 3024 wrote to memory of 2208	3024	Unicorn-32633.exe	45
PID 3024 wrote to memory of 2208	3024	Unicorn-32633.exe	45
PID 3024 wrote to memory of 2208	3024	Unicorn-32633.exe	45

C:\Users\Admin\AppData\Local\Temp\a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe
"C:\Users\Admin\AppData\Local\Temp\a932742ef3541d301715bcc94ef1c51882beeeb4d419898022661aef6d72ad3dN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19012.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58529.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
        8⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28234.exe
        9⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
        9⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53972.exe
        9⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30040.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60936.exe
        9⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        8⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65165.exe
        8⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        8⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27895.exe
        8⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37579.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        8⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34402.exe
        8⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        7⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5493.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11405.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34966.exe
        7⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        7⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
        8⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24942.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        8⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exe
        8⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13491.exe
        8⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19603.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10139.exe
        7⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        7⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30172.exe
        6⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        7⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        7⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10651.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        6⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26191.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
        6⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
        6⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
        7⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        8⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
        8⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9976.exe
        8⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
        8⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41128.exe
        7⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53127.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        7⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        6⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13791.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36624.exe
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        7⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1387.exe
        6⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
        6⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44117.exe
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14294.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3926.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27895.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57099.exe
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51393.exe
        6⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        5⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44979.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        5⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64873.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
        5⤵
        
        PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32633.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41866.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14367.exe
        8⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        8⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        8⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
        8⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26800.exe
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        8⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        7⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe
        7⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        7⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
        7⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        7⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11528.exe
        7⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2783.exe
        6⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62395.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6988.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4808.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        7⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13791.exe
        8⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26213.exe
        8⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        7⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13491.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28044.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6988.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        6⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        7⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        7⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
        6⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        6⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13324.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24864.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe
        7⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
        6⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41415.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        7⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34807.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19416.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59759.exe
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        7⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26733.exe
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27334.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        7⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-288.exe
        6⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30930.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44117.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
        5⤵
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
        5⤵
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        5⤵
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64398.exe
        5⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8285.exe
        6⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14978.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44117.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22161.exe
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
      4⤵
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60792.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28943.exe
      4⤵
      PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4660.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
      4⤵
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9836.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65218.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
        8⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        8⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64086.exe
        8⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31903.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27988.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        7⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        7⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24709.exe
        7⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        6⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54959.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19630.exe
        8⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        8⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29223.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35089.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61312.exe
        7⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1772.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29172.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14506.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37279.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52101.exe
        7⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20324.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50401.exe
        5⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37502.exe
        6⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53112.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33823.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26987.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59760.exe
        5⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-418.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46136.exe
        6⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        6⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14021.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50046.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25630.exe
        5⤵
        
        PID:6424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        6⤵
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34534.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
        5⤵
        
        PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20371.exe
        5⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37231.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
      4⤵
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37668.exe
      4⤵
      PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27988.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39211.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
      4⤵
      PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20202.exe
      4⤵
      PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20580.exe
        6⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        5⤵
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34354.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6186.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59463.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28460.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46334.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63033.exe
      4⤵
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
      4⤵
      PID:5368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9914.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        5⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30227.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24431.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6380.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
      4⤵
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
      4⤵
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
      4⤵
      PID:5844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
      4⤵
      PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
      4⤵
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
      4⤵
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3477.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27618.exe
    3⤵
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55474.exe
    3⤵
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63882.exe
    3⤵
    PID:6968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29597.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29597.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52966.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
        9⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8752.exe
        9⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        9⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        9⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        9⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49022.exe
        8⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        8⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        8⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        8⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        8⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        8⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        7⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        8⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22156.exe
        8⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        8⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
        7⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        7⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16245.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13542.exe
        7⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        7⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22910.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11309.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45148.exe
        6⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3371.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64791.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19650.exe
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27988.exe
        6⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        5⤵
        
        PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14945.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23617.exe
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63573.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23006.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35089.exe
        6⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61312.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        5⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46364.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35243.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1068
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 220
        5⤵
        Program crash
        
        PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe
      4⤵
      PID:744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10669.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
      4⤵
      PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6375.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
        5⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6390.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
        6⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36774.exe
        5⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44270.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52631.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3158.exe
        5⤵
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4414.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
        5⤵
        
        PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56727.exe
      4⤵
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63033.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
      4⤵
      PID:6692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4049.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34923.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58223.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33634.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
      4⤵
      PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
      4⤵
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
      4⤵
      PID:6600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38970.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17549.exe
      4⤵
      PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8923.exe
      4⤵
      PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10511.exe
      4⤵
      PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
    3⤵
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10552.exe
    3⤵
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
    3⤵
    PID:3276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
    3⤵
    PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
    3⤵
    PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26081.exe
    3⤵
    PID:6960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38528.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9050.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52451.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
      4⤵
      PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
      4⤵
      PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6988.exe
      4⤵
      PID:6308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10734.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        5⤵
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
        6⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        6⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1041.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
        5⤵
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
        5⤵
        
        PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22659.exe
      4⤵
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13791.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36624.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
      4⤵
      PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
      4⤵
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
      4⤵
      PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39519.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43858.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
      4⤵
      PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7651.exe
      4⤵
      PID:7088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
    3⤵
    PID:7164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10371.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52592.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30457.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23189.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34635.exe
      4⤵
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52592.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61183.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23189.exe
      4⤵
      PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7693.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4419.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
      4⤵
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34059.exe
    3⤵
    PID:2344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
    3⤵
    PID:3528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exe
    3⤵
    PID:6520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27414.exe
      4⤵
      PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13065.exe
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48768.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29633.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52358.exe
      4⤵
      PID:6800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
    3⤵
    PID:2476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
    3⤵
    PID:3532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
    3⤵
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22101.exe
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
    3⤵
    PID:5912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
    3⤵
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22697.exe
    3⤵
    PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29542.exe
    3⤵
    PID:5980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
    3⤵
    PID:7108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
  2⤵
  PID:552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16668.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16668.exe
  2⤵
  PID:3156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
  2⤵
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
  2⤵
  PID:5376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
  2⤵
  PID:6652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe

Filesize
468KB

MD5
1ffa4ba6c7f86ad165c73add7a63f876

SHA1
26f1976ca4cdf01f0368b89918f4f305ed76feb2

SHA256
73513674c2abbcb99453d0d076dc99454c69ee0a22e58148d8e8f50c16b5c6c2

SHA512
af023b8264680dd18a5c218a6a35f957628072bc1dd737e38d90b716fbcfe3e3a19a488e6c315349512ed021b1cf4c37d4afb8899eb332444a8998cb70f1b726

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe

Filesize
468KB

MD5
c06445e2e9eb308f694eec9af5984e4f

SHA1
a430ab672f951f91510c616838bf6b704d8fccde

SHA256
defd0fab851f77a1adf43cbcb916c0e00587b41e4c3a44b23445d586693c9761

SHA512
d38563abdeb892c62c797e53612cc6be982658357d6eaa71bcadc6689870356965e971e5de5bec986b814b758f04025e5d5953559c9f815624b2f240c010a76e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31903.exe

Filesize
468KB

MD5
8bae65d01b34ac25035508cb9057718c

SHA1
d19676113b21bd45e38fd2db7adfcaebc957a8a0

SHA256
7c3a979e539abe79befc36c35d346cc9f0af6f1bc21ebee94bfd4240995f5446

SHA512
df6ecfe73170b027ca71b10c436b326f5ab33e245813cbf14fd5e425faf15dc852708ed9bd0ad0abebab9c8b1fc0d7fee630dd7674fc80275cd4ef9c8dc8167f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe

Filesize
468KB

MD5
2f589ff48cffa765d55f389092d0485f

SHA1
1f579e17990ddfbc2f84409c19a938ef94f95883

SHA256
1526057a53ba5c05dcb2450b8b84f7ca6f4d4d3f5ee7c6edfcf2b7290f86b632

SHA512
c1aa66926d6b7cd6646409929973a1bef8d7c187f07c2b5894ac55935a13148e8b122041f92184b34b4cfe52bea2399fe904081353a940c7a6d2a811a1adcfea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe

Filesize
468KB

MD5
71a9b8d6fdcc6dd8a2e5c2e57aaa8341

SHA1
35a3c5e1f020e20d4bfa3ef10bea0f0a941e224d

SHA256
c8c0c5060a5d94d986d6ce5acbf9686c97fa668b77d586ce751c683fef4e0ead

SHA512
c3dc15a696555ea8f6aa83ce5b5c35876a8dcb0e749badc7398b746b371da3ca963fceb3e3f5f34fba82c52a0194d754747c1756f2d5d9494643c3b74acbc419

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe

Filesize
468KB

MD5
fc9e38d169ff10b99c51424b6389839f

SHA1
cafc25833b5b06967c6129bb9dd2f2ee5c0a6abb

SHA256
7c927ce3ca65a81e45cc33e02207a77bcac7843bb02c3c3370c8f10cbea046ea

SHA512
6f7fef4608bb881f12ececf004dfa6dd5775208b755782d368fe2ac1c9db1d4035673237d51028f3b630df5c4e3aa9e8e96b1142bb232aed5f997cf27c62a51c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50046.exe

Filesize
468KB

MD5
f78c7f0c69cddbc35589d206ec3c96e1

SHA1
934cfce9b4511c5bb85b1870902bce99e8f39944

SHA256
afb74df36add225e2154d82cdf2c58bbab9d8295dfee56531ddc7248fc05166f

SHA512
d70b12331764ce7ea81cf1debf5b6825e39a643b5a5c8ddc5cb52f8180d3f70e195de28975a4fdeef04e083bdc6e29802de759977f1684c3a287d113542a9cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe

Filesize
468KB

MD5
a8a8f530e095434ff19a399c2a0eeda1

SHA1
b23c5467d9c923d8d651ea8aba62aed62dc9dbae

SHA256
3c5964eeef81896efed72a7b3a8312fbd7899c4f51dddc71d6f151910efddfaf

SHA512
30e5f5d5d1791c1b82efa8435d30e4742cdf98ae478c4493c25c30aeb1504abae6a70cd7a3f494f0628d52d8e7490e0f385462a99034b4a377377806e9ef8a7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65165.exe

Filesize
468KB

MD5
c03c4868a266240a3be63bedc2bda83a

SHA1
90e28ce2c5b8a793af682d872e9faa15510cb179

SHA256
94bed69138ec1f19dc81a93fafae0308aaf05d98e4c30960546bce0b354a1308

SHA512
2082ae1868472ee178e44c418e29e75a6b18af4faf739d2a0517fec49addcd2137bf793116d1ddd9dd41fba0a9b310b486d57ee770d50c5f43747dfd1a71ab28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe

Filesize
468KB

MD5
d121301fb71488cf494e60576abf72c4

SHA1
e7c903a36e55c32759f554a22a865b90ab14a345

SHA256
c10db2571a557aaaffd5ea350eacc08af84f08f75d3036dc0e9fc4585a02408a

SHA512
3bc2c9b719e8a5d8d820e02380443d8fd82ad3a842f3c44dca9f94d3efb7c626b7d1725733107919e30923b1dcbe555aa241809a8929a10e3231cfe26c27ef09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9836.exe

Filesize
468KB

MD5
89484b8e0efd425ab389b593bf057ba7

SHA1
bda014a0e8eacf6158a47f479d32fa541370f9bb

SHA256
13ea82d8b47e96ec5ac0d6913cef1f2c7fdc6a6c048351153ede22962293017f

SHA512
0e8835c6fa39c6caabb1b9811370ed3113189d87817ca907b4a2c586656742b2ac5a9ebd2f3f6b725a0f46cbe0071c2b587ebfaf29b15f13dd9a4a39d98c70e0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe

Filesize
468KB

MD5
e3cdc93f12972c7e887d86d0bb32b8b8

SHA1
6f1d9428ff0fe738fd640ab603d78c504f7d87b7

SHA256
52fe676e372084f2cb16155f12af6be4f97f2298c094e76c3220f41e3f576943

SHA512
336fbc6c1d06786d44a8149aeaf411a9b7e47216171e9da86c637771abb950999285ab9e78c9fc44d8bce5244144345f447f6a93b29bd2c51f42e4c2e06f343a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19012.exe

Filesize
468KB

MD5
9f22abf1f3cf56ba6c8d1d9a85ec3146

SHA1
9fd3a2622d213af12a768e1c82ce17eadfe96ddb

SHA256
44267c089fbb6a45d4fd6b94681891a7c39d5be508e3c80d065fe8e2d50fbd80

SHA512
e8020ad2556c45756747d45549c4a76eea16a0d65abe3d9199fad14f25a73b97da38543d9951cc1b54f63d3506712b9e39cc53a2e3df065ebd3b0146b908be85

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe

Filesize
468KB

MD5
9b77bdc2f41a279db4c1c8fc27e9b0eb

SHA1
65964955069677a9705a742f59ef0c8847c7f61b

SHA256
1cfb5790bbaa393c1ec4c8e81dc910263c4185327f8499afe54754ba7f6504f3

SHA512
20b42aa3772bf554455fddff157ff2d27a154a64af598fa943b19e7a1bbc23baa3b23ff65ea0436f167fca6ae70ac8948966b959121f1a66d28ace2ab827e8c0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe

Filesize
468KB

MD5
42709f08039e6ed365220afaf9e81b3a

SHA1
f3d9f03690d13cadab4c36af427a08ca3e09afa4

SHA256
0b29cf4317962a23b42c134507062515c8a2b2ea1623d28ca6eb5a3f613b24a2

SHA512
1caf12fae4ee28a35c8c3befee7fe4a2c48bcf5dd8325c0084ed6ee0f67b4b2ed607d05b170c5366456ba34f857e75acebe5400699e9aaad4e2b5912e78df86b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29597.exe

Filesize
468KB

MD5
1f046886e529f1ca953da3e423fb9d9f

SHA1
50524be0b899da84f1d5dfc5a4adbd896acac3dd

SHA256
1694c1a5dcbb9cc27861348a1837b69ccdab5e74f8273378314fb1d8f03a20de

SHA512
895e93d4aae628d6dc30c13d57af4f92d94f2b4ffa56eb900147f53d2da6e38528fcfdb2c14a68952a04d1f5a96831597d206abe02b93b573dfb53e14f53b597

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe

Filesize
468KB

MD5
0f086ce58a60e7889de18840dab12232

SHA1
5e2fcd39dc88d60f83cba9a7b624194615b6af0b

SHA256
1d05a1a6f6d4ec009124e84dc6c6c277cdb19115428552b21e874b5b7a1352a6

SHA512
0ebb5282f53e30eb892245c4b4a5ba3a5b45be031f4e7e50f03575ddeafd38477d20720d00668a15b18822bbbdafe902b16d6b6347d0dbd802b2a942526c7c6e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32633.exe

Filesize
468KB

MD5
1f0521063686f4940584a11f313649e1

SHA1
9155a4127a9bc632a852d421cd7b4cb78654d1d5

SHA256
4e377fec00870a415e7d3329ed0c1eda2e445df0e7f070efa17c8b067f52e834

SHA512
8c1e1f5696cf3fb0ffd78d3046f330c2c6e680ebe750a57b39b3ff2c36c305a5534fd8bc617ddaf8c16beef20c0b2cb37ba4da006443a7aae421657eb99e80fe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe

Filesize
468KB

MD5
fe3cc895ceb67b9cf70a0b85dc363623

SHA1
d57686e09039cb7c8209ea31d7e8395114100bd5

SHA256
99fd69204cf174e16f21c1771035bba34481b9a5d33681394f98edeef7df8b07

SHA512
1c89ab68b0403282d727bc3888acf7896329f3b81c92125b59ef2cd326913d0c0bf5ceb863314e7d7df80831721379df2f6136ce3820762dbcacb26903ec95b1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe

Filesize
468KB

MD5
bf5d6edc2bd715f9facc67195fc469e6

SHA1
cd76137e17ddf83ea2d3795ec622b59538b25ec3

SHA256
02fdb4f3f81537be76433124ee7f7eb06caaed1c0b8b2a94e3d235d71c58c982

SHA512
8f8b5efcb035be4f712ec91b74ad5288722772f3531530f2c5dd51ba11ce8ca8e04db5ef45f6056534ff8b934d8e90bb95f7501dee9d80143455333d2fa489d2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe

Filesize
468KB

MD5
8ff6845665e111db35d17f8642e4cc91

SHA1
abc2beef0cbf62150c8a5b08e09b5c6c56d5150d

SHA256
f3d3c67140bb72c9c9e109fbb7610305c53f3753c7cd08286ae36c156a6e8526

SHA512
9ca09f35c23e188cd87b391aeb8808b705a59b94a6441af7770976f0470dedd56498f69a4476db1e070499404a055d9fa2252ba9b2c09439931af4f4e4fb2d53

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe

Filesize
468KB

MD5
5f30a710f0d04947e4c6217f4faf7fd7

SHA1
a3c4c41102453b0d74a874e41ff4be96cd6958b3

SHA256
c42bc9ccbf002df53aceec39a81a96c85a0f320e1a74eea223c062c5caf6ffac

SHA512
4d3896f2c738ecf72790f0d9174d04466949ebd19e4e069bde6da133fc2cb354db4d45a45ef72dbee27ceba0507bf7eac9b4aef15bc904f0c1fd4f08afc53e92

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe

Filesize
468KB

MD5
48d686de44c50b5f8e179daf30607c91

SHA1
bbf1daf8ff36622bdeef51c1524be7d8dd9613e4

SHA256
0612466429792be7801e3669c70fc3ff851fa8d1ecf4e9a1a98c342d9845e9d8

SHA512
721b86b457a935948282d490a7609af950abfa59b3e371af0faf2894da71d0072e937a186e11991133a6461f1240b0cf1e7b0e6118b821a8a88c3853e985e223

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58529.exe

Filesize
468KB

MD5
7c8eafa2df97ad62a659722ad75340ac

SHA1
403bc5c8c1cd1827faae99b8fad709d872d0e066

SHA256
58514530df1999227b65b11c42c9584577094e257033d3ed4383fe54741feb16

SHA512
6038882ea09a4bd86517f9c7243becbd819e433451743be4b579d83071ef22fdecd526a826ff210f9e566b5166218d998a21533efaea288c2d2b907aabdd0049

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6375.exe

Filesize
468KB

MD5
03fae8940abc33d343ad4460166be3bb

SHA1
4134b874930fe7be11573d984fce467b5954848f

SHA256
2f297a32d9a6711b2922b446b8a39af22b2aa9d515993f2447a481554ef9f110

SHA512
47874afc0107b3269ce5b4cdcd8c1d5b477a36035469720d9bd2a162e3484a70304c7bc0e0d1bc6db325e4fc014fea16c1c73f324751bbeb83e542767c0fe7ab

Download Submit