0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
Size

468KB
MD5

fa0fae788e2700224c611ac82f547fc0
SHA1

d5078b6e62e604da7e6ae9a4c99b025671aa8900
SHA256

0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15
SHA512

2e172305a16c0460b9912060f0750e6c464e50044542fb4217471f7178ab0f178cff79ab72c7fbda54c02d3a6844969eedef7cf0586185fb7228e2b3f038f10a
SSDEEP

3072:p8nCoMIdIU57tbY6PzcjYf//sCh37IagBRHQOV1MeUHfY05yQgl3:p8Cokc7tVP4jYfL/bLeU/55yQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1412	Unicorn-63355.exe
2816	Unicorn-65145.exe
2892	Unicorn-15389.exe
2804	Unicorn-12120.exe
2664	Unicorn-54999.exe
2820	Unicorn-24927.exe
2732	Unicorn-44793.exe
2612	Unicorn-41944.exe
1300	Unicorn-62483.exe
468	Unicorn-46220.exe
880	Unicorn-33968.exe
1636	Unicorn-14102.exe
1708	Unicorn-38052.exe
2300	Unicorn-64263.exe
2376	Unicorn-18600.exe
2432	Unicorn-43418.exe
2392	Unicorn-47502.exe
2940	Unicorn-1623.exe
1012	Unicorn-27828.exe
1916	Unicorn-38950.exe
744	Unicorn-16483.exe
956	Unicorn-26698.exe
900	Unicorn-55841.exe
2028	Unicorn-10169.exe
1700	Unicorn-59370.exe
1644	Unicorn-33011.exe
2368	Unicorn-23360.exe
1964	Unicorn-47310.exe
3024	Unicorn-47310.exe
700	Unicorn-14180.exe
860	Unicorn-60117.exe
1872	Unicorn-3620.exe
2960	Unicorn-12172.exe
2956	Unicorn-16811.exe
2456	Unicorn-45400.exe
2480	Unicorn-3812.exe
2188	Unicorn-46883.exe
2672	Unicorn-53013.exe
2660	Unicorn-60605.exe
2780	Unicorn-35139.exe
2056	Unicorn-32571.exe
2824	Unicorn-33169.exe
2584	Unicorn-8664.exe
2532	Unicorn-1051.exe
3048	Unicorn-36184.exe
2588	Unicorn-16318.exe
3012	Unicorn-17579.exe
1852	Unicorn-56988.exe
2864	Unicorn-61949.exe
1884	Unicorn-32027.exe
2032	Unicorn-13333.exe
2852	Unicorn-33753.exe
964	Unicorn-20018.exe
2568	Unicorn-11487.exe
2160	Unicorn-35992.exe
2224	Unicorn-35727.exe
2180	Unicorn-29861.exe
2900	Unicorn-8363.exe
1148	Unicorn-41782.exe
1256	Unicorn-40274.exe
2132	Unicorn-13407.exe
1124	Unicorn-50911.exe
2036	Unicorn-54248.exe
1548	Unicorn-29744.exe

Loads dropped DLL 64 IoCs

pid	Process
2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
1412	Unicorn-63355.exe
2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
1412	Unicorn-63355.exe
2816	Unicorn-65145.exe
2816	Unicorn-65145.exe
2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
1412	Unicorn-63355.exe
1412	Unicorn-63355.exe
2892	Unicorn-15389.exe
2892	Unicorn-15389.exe
2664	Unicorn-54999.exe
2664	Unicorn-54999.exe
2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
2732	Unicorn-44793.exe
2732	Unicorn-44793.exe
2892	Unicorn-15389.exe
2820	Unicorn-24927.exe
2820	Unicorn-24927.exe
2804	Unicorn-12120.exe
1412	Unicorn-63355.exe
1412	Unicorn-63355.exe
2892	Unicorn-15389.exe
2804	Unicorn-12120.exe
2816	Unicorn-65145.exe
2816	Unicorn-65145.exe
1300	Unicorn-62483.exe
1300	Unicorn-62483.exe
2612	Unicorn-41944.exe
2612	Unicorn-41944.exe
2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
2664	Unicorn-54999.exe
2664	Unicorn-54999.exe
2300	Unicorn-64263.exe
2300	Unicorn-64263.exe
2816	Unicorn-65145.exe
2816	Unicorn-65145.exe
468	Unicorn-46220.exe
468	Unicorn-46220.exe
2732	Unicorn-44793.exe
1636	Unicorn-14102.exe
2732	Unicorn-44793.exe
1636	Unicorn-14102.exe
880	Unicorn-33968.exe
880	Unicorn-33968.exe
2892	Unicorn-15389.exe
2892	Unicorn-15389.exe
2820	Unicorn-24927.exe
1708	Unicorn-38052.exe
2376	Unicorn-18600.exe
1708	Unicorn-38052.exe
2820	Unicorn-24927.exe
2376	Unicorn-18600.exe
1412	Unicorn-63355.exe
1412	Unicorn-63355.exe
2804	Unicorn-12120.exe
2804	Unicorn-12120.exe
2392	Unicorn-47502.exe
2392	Unicorn-47502.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3636	1000	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31858.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
1412	Unicorn-63355.exe
2816	Unicorn-65145.exe
2892	Unicorn-15389.exe
2804	Unicorn-12120.exe
2664	Unicorn-54999.exe
2820	Unicorn-24927.exe
2732	Unicorn-44793.exe
2612	Unicorn-41944.exe
1300	Unicorn-62483.exe
468	Unicorn-46220.exe
2300	Unicorn-64263.exe
1636	Unicorn-14102.exe
1708	Unicorn-38052.exe
880	Unicorn-33968.exe
2376	Unicorn-18600.exe
2432	Unicorn-43418.exe
2392	Unicorn-47502.exe
2940	Unicorn-1623.exe
1012	Unicorn-27828.exe
1916	Unicorn-38950.exe
744	Unicorn-16483.exe
956	Unicorn-26698.exe
2028	Unicorn-10169.exe
900	Unicorn-55841.exe
1700	Unicorn-59370.exe
1644	Unicorn-33011.exe
3024	Unicorn-47310.exe
2368	Unicorn-23360.exe
1964	Unicorn-47310.exe
700	Unicorn-14180.exe
860	Unicorn-60117.exe
1872	Unicorn-3620.exe
2960	Unicorn-12172.exe
2956	Unicorn-16811.exe
2456	Unicorn-45400.exe
2480	Unicorn-3812.exe
2672	Unicorn-53013.exe
2188	Unicorn-46883.exe
2660	Unicorn-60605.exe
2780	Unicorn-35139.exe
2056	Unicorn-32571.exe
2824	Unicorn-33169.exe
2584	Unicorn-8664.exe
2588	Unicorn-16318.exe
2532	Unicorn-1051.exe
3048	Unicorn-36184.exe
3012	Unicorn-17579.exe
2864	Unicorn-61949.exe
1852	Unicorn-56988.exe
2032	Unicorn-13333.exe
1884	Unicorn-32027.exe
2852	Unicorn-33753.exe
964	Unicorn-20018.exe
2568	Unicorn-11487.exe
2224	Unicorn-35727.exe
2180	Unicorn-29861.exe
2160	Unicorn-35992.exe
2900	Unicorn-8363.exe
1148	Unicorn-41782.exe
1256	Unicorn-40274.exe
2132	Unicorn-13407.exe
2036	Unicorn-54248.exe
1124	Unicorn-50911.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1412	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	31
PID 2488 wrote to memory of 1412	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	31
PID 2488 wrote to memory of 1412	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	31
PID 2488 wrote to memory of 1412	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	31
PID 2488 wrote to memory of 2816	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	33
PID 2488 wrote to memory of 2816	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	33
PID 2488 wrote to memory of 2816	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	33
PID 2488 wrote to memory of 2816	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	33
PID 1412 wrote to memory of 2892	1412	Unicorn-63355.exe	32
PID 1412 wrote to memory of 2892	1412	Unicorn-63355.exe	32
PID 1412 wrote to memory of 2892	1412	Unicorn-63355.exe	32
PID 1412 wrote to memory of 2892	1412	Unicorn-63355.exe	32
PID 2816 wrote to memory of 2804	2816	Unicorn-65145.exe	34
PID 2816 wrote to memory of 2804	2816	Unicorn-65145.exe	34
PID 2816 wrote to memory of 2804	2816	Unicorn-65145.exe	34
PID 2816 wrote to memory of 2804	2816	Unicorn-65145.exe	34
PID 2488 wrote to memory of 2664	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	35
PID 2488 wrote to memory of 2664	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	35
PID 2488 wrote to memory of 2664	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	35
PID 2488 wrote to memory of 2664	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	35
PID 1412 wrote to memory of 2820	1412	Unicorn-63355.exe	36
PID 1412 wrote to memory of 2820	1412	Unicorn-63355.exe	36
PID 1412 wrote to memory of 2820	1412	Unicorn-63355.exe	36
PID 1412 wrote to memory of 2820	1412	Unicorn-63355.exe	36
PID 2892 wrote to memory of 2732	2892	Unicorn-15389.exe	37
PID 2892 wrote to memory of 2732	2892	Unicorn-15389.exe	37
PID 2892 wrote to memory of 2732	2892	Unicorn-15389.exe	37
PID 2892 wrote to memory of 2732	2892	Unicorn-15389.exe	37
PID 2664 wrote to memory of 2612	2664	Unicorn-54999.exe	38
PID 2664 wrote to memory of 2612	2664	Unicorn-54999.exe	38
PID 2664 wrote to memory of 2612	2664	Unicorn-54999.exe	38
PID 2664 wrote to memory of 2612	2664	Unicorn-54999.exe	38
PID 2488 wrote to memory of 1300	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	39
PID 2488 wrote to memory of 1300	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	39
PID 2488 wrote to memory of 1300	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	39
PID 2488 wrote to memory of 1300	2488	0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe	39
PID 2732 wrote to memory of 468	2732	Unicorn-44793.exe	40
PID 2732 wrote to memory of 468	2732	Unicorn-44793.exe	40
PID 2732 wrote to memory of 468	2732	Unicorn-44793.exe	40
PID 2732 wrote to memory of 468	2732	Unicorn-44793.exe	40
PID 2820 wrote to memory of 880	2820	Unicorn-24927.exe	42
PID 2820 wrote to memory of 880	2820	Unicorn-24927.exe	42
PID 2820 wrote to memory of 880	2820	Unicorn-24927.exe	42
PID 2820 wrote to memory of 880	2820	Unicorn-24927.exe	42
PID 1412 wrote to memory of 2376	1412	Unicorn-63355.exe	44
PID 1412 wrote to memory of 2376	1412	Unicorn-63355.exe	44
PID 1412 wrote to memory of 2376	1412	Unicorn-63355.exe	44
PID 1412 wrote to memory of 2376	1412	Unicorn-63355.exe	44
PID 2892 wrote to memory of 1636	2892	Unicorn-15389.exe	41
PID 2892 wrote to memory of 1636	2892	Unicorn-15389.exe	41
PID 2892 wrote to memory of 1636	2892	Unicorn-15389.exe	41
PID 2892 wrote to memory of 1636	2892	Unicorn-15389.exe	41
PID 2804 wrote to memory of 1708	2804	Unicorn-12120.exe	43
PID 2804 wrote to memory of 1708	2804	Unicorn-12120.exe	43
PID 2804 wrote to memory of 1708	2804	Unicorn-12120.exe	43
PID 2804 wrote to memory of 1708	2804	Unicorn-12120.exe	43
PID 2816 wrote to memory of 2300	2816	Unicorn-65145.exe	45
PID 2816 wrote to memory of 2300	2816	Unicorn-65145.exe	45
PID 2816 wrote to memory of 2300	2816	Unicorn-65145.exe	45
PID 2816 wrote to memory of 2300	2816	Unicorn-65145.exe	45
PID 1300 wrote to memory of 2432	1300	Unicorn-62483.exe	46
PID 1300 wrote to memory of 2432	1300	Unicorn-62483.exe	46
PID 1300 wrote to memory of 2432	1300	Unicorn-62483.exe	46
PID 1300 wrote to memory of 2432	1300	Unicorn-62483.exe	46

C:\Users\Admin\AppData\Local\Temp\0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe
"C:\Users\Admin\AppData\Local\Temp\0fa1965b2d028d5c225834bf1a6e5f725a3f9e43d0a120558e742912a07d6f15N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15389.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44793.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61949.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
        8⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe
        9⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        9⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        9⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
        8⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        8⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45269.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43448.exe
        7⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42031.exe
        8⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22007.exe
        7⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        7⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        6⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        7⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        7⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7944.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        6⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        6⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        7⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        7⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        7⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
        6⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34394.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33753.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        6⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2427.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        7⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        6⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
        5⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34148.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26438.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        5⤵
        
        PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33169.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45035.exe
        8⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35377.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
        8⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        8⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
        7⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        7⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23412.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        7⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24069.exe
        6⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39277.exe
        6⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3842.exe
        7⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
        7⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50200.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62311.exe
        5⤵
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41067.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39277.exe
        6⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        7⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27869.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36321.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
        5⤵
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7915.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32579.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33579.exe
      4⤵
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        5⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10770.exe
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43106.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26521.exe
      4⤵
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62873.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33968.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64248.exe
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        7⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64533.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        6⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        6⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61076.exe
        5⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
        5⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        5⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51279.exe
        5⤵
        
        PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe
        5⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35302.exe
        6⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44143.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        7⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        6⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        5⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        6⤵
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22007.exe
        5⤵
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        5⤵
        
        PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
      4⤵
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        5⤵
        
        PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
      4⤵
      PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18600.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47310.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
        6⤵
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe
        5⤵
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        5⤵
        
        PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        5⤵
        
        PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        5⤵
        
        PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31473.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63957.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        5⤵
        
        PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
      4⤵
      PID:272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34446.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        5⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49347.exe
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25217.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
      4⤵
      PID:6788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8363.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31473.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
        5⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47616.exe
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6630.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40274.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
      4⤵
      PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
      4⤵
      PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
      4⤵
      PID:6804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38891.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43106.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
    3⤵
    PID:4320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62873.exe
    3⤵
    PID:6228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65145.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65145.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47310.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16008.exe
        7⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41569.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16370.exe
        6⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40605.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        6⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41782.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
        6⤵
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45269.exe
        6⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        6⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17853.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8119.exe
        6⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        8⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        8⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31858.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        7⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9313.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43448.exe
        5⤵
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13442.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        5⤵
        
        PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
        5⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49630.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28017.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
        5⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37095.exe
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
      4⤵
      PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
      4⤵
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51163.exe
      4⤵
      PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64263.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38950.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60605.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1202.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35336.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16818.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29580.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21854.exe
        5⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48759.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58051.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        5⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        6⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        6⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        5⤵
        
        PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
      4⤵
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47391.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44832.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        5⤵
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6199.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
      4⤵
      PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
      4⤵
      PID:6328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58571.exe
        5⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43448.exe
      4⤵
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        5⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52778.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
      4⤵
      PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34394.exe
      4⤵
      PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64859.exe
      4⤵
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20824.exe
      4⤵
      PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
      4⤵
      PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
      4⤵
      PID:6528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
    3⤵
    PID:2596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20991.exe
    3⤵
    PID:3332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
    3⤵
    PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21532.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54999.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54999.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1669.exe
        7⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47267.exe
        8⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe
        8⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
        7⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
        6⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
        6⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38566.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37367.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54248.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20297.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47868.exe
        6⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        5⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        6⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe
      4⤵
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
        5⤵
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39700.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19634.exe
      4⤵
      PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24840.exe
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
      4⤵
      PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3812.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29360.exe
        5⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
        6⤵
        
        PID:2140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 232
        6⤵
        Program crash
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25496.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5301.exe
      4⤵
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31602.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18844.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27338.exe
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
      4⤵
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
      4⤵
      PID:6204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3759.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
      4⤵
      PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
      4⤵
      PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63049.exe
    3⤵
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
      4⤵
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24273.exe
      4⤵
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28599.exe
      4⤵
      PID:6504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20991.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43532.exe
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe
    3⤵
    PID:6240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        5⤵
        Executes dropped EXE
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        6⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-286.exe
        6⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        5⤵
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29580.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33037.exe
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
      4⤵
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        5⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        5⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        5⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
        5⤵
        
        PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31195.exe
      4⤵
      PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37339.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55782.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
      4⤵
      PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45400.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
      4⤵
      PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
      4⤵
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe
    3⤵
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56203.exe
      4⤵
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
      4⤵
      PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
      4⤵
      PID:6988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
    3⤵
    PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
    3⤵
    PID:6164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29443.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64248.exe
        5⤵
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        6⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1370.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        5⤵
        
        PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
      4⤵
      PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
      4⤵
      PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30893.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50697.exe
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
      4⤵
      PID:6836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37967.exe
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
    3⤵
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
    3⤵
    PID:5644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
    3⤵
    PID:6852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
    3⤵
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exe
      4⤵
      PID:756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7915.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36378.exe
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
    3⤵
    PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42032.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
    3⤵
    PID:6812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45035.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21650.exe
    3⤵
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
    3⤵
    PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
    3⤵
    PID:7108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52480.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52480.exe
  2⤵
  PID:3492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37771.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37771.exe
  2⤵
  PID:4112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
  2⤵
  PID:5532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
  2⤵
  PID:6268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe

Filesize
468KB

MD5
803b4d7534c3875021300ff44c600ba8

SHA1
9a1906c088dc497e0cafa50335ddc8a20989a2d7

SHA256
442d1969afbfaad670ff8d685a122e7a4ad22797e3eb4b877ef41c8861441210

SHA512
ba44285e07c18655bbfbe885550aeea392f4e054db2667b339eb62a8fc5bed7fddcda5587aabf1afbbae71f58cd2ae0a36ebf77a436f7484e0a9bfa7346a6d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64263.exe

Filesize
468KB

MD5
c7bd86096045228615b9eee3e5065a0f

SHA1
c8fb400d8800103a8e410aa4d6483b7ead5416d5

SHA256
0e74574f952b1f9d3f010ea1a993f48257e6be2613b801baf42942a32315817e

SHA512
b97a4e7d380b291b7035c60be9cbd4f46d6dcf37a57c73324f427601055043eaf6f3118f7174f0a697d0b3a233462bf2bc0b61e4695831337db4bf24d6c27b0c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe

Filesize
468KB

MD5
53b1f69982d3e2988ad68a76a1647434

SHA1
c828b4a9d2fb2433a4f74a3a228898d657afc825

SHA256
90de6170d6e03bc024407e3694580031cc671abc3c069ce39d0c5a8c4f42f13d

SHA512
a0485179613049d974f86b18d9262e0baaeba3ca651dfca51f7b731aed1d255e2e80a10e1b0b3d00343ef7d8962bc9461fba4baa9961d83dd06bd6ed15537945

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe

Filesize
468KB

MD5
c1844d82fd499435a25439975abe9577

SHA1
84a168e738d51fe8efe429ede21c43b453e83ab0

SHA256
4ab3e5a71ffca581fbf13f56f6ca0b3f12633342810fbaeb070f2f7572ba1aef

SHA512
e594db1ea7239bd0b8e5b33bfa81812de4cb5be5ae6a00b2960d86d89beb58b38c84c7c9d024d9bc0033f4dabe13972abb4e6ae34c92192c0855ee5cd33e7e07

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15389.exe

Filesize
468KB

MD5
053198b05d7ae5c517653a15432a0c08

SHA1
8f8777f396d035023df48719ed323ccd8fbe56e7

SHA256
a6560119de0e56877f0d1334a5f548d4286a83acb5286bc515cce8e0fbe003f9

SHA512
268c81027f6995d9dd27290e1257849933f7227a7d4e2fe5cf9dbc6b22e3af66d0e35b3a244506fe67520b749f5758e315fd2bdf12d7a6548c32d4cd31e97f45

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe

Filesize
468KB

MD5
1c8f7f69020223d29ab7c973a5c654fc

SHA1
8c9737f2823dcefa2744a6d98b32d70c4aec3630

SHA256
d94558fdae4e39fd5a5d25d0f893935227c9bbfd95bff4ffab1f5e8877c5084d

SHA512
1f5f3006cb7700cce5365605ecdade50d818ab1da33ad05b4263d5fc60b149de5779229072867080707e3dd61694ff042608ddb29db2cb726421ce496f937f36

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18600.exe

Filesize
468KB

MD5
0fac3cf92c905c2e49532b704ee74ec9

SHA1
90b1508e1131a02b4ffa9fc26e3752929ba07a70

SHA256
ecfa0db38598a29eb82df87444eccfc5693a6f54f01ceab7a7aa666aff27497d

SHA512
418923622e680c2ef5626955d983ed41671cfec7a8828e80fcac83448b95108b90f11071980d212a6c3854c961ae0c31eda7414de1bd66743701c9634e027f21

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe

Filesize
468KB

MD5
7015625b053154e5566b3bb08ca0d119

SHA1
8fe9a185acaa3c08ff7fb05a2c4041eb96895739

SHA256
f853cd96a1e072672ee5834ffaa5c0f089776724524824e60ecf7932c78cdef5

SHA512
d585c78006b4b51a396f6d154217ddc63b817d7ca6813ac675ade0acca18579e1ac35f548a3cdd19c026ecde40f940b6f56422917d44a0680680a498601c3a3f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe

Filesize
468KB

MD5
31f18d11785d82a873057bb414be21e8

SHA1
ca8bbca7d4e41f403f01d9daebebcd2ab910839e

SHA256
f10c0d428576908e39e85788efb0172862061717d432123b771f5dd8a4a7b078

SHA512
034762ee1552794b8d5eb46145d1a20f6b80ac21700efb8e5bd4d435422f74fb1cd82879304b42349f36d3cf724785978e564f97af658225744921381405635e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33968.exe

Filesize
468KB

MD5
d712fb4ee9ab38dd305d0531606729c5

SHA1
5d678f6890058289ce3c3307ea75bb1ad7a76129

SHA256
92a63ff15bac6f17b419bb4941ffaa67dfd6c9a3c1b549b3b69852c7c8c43504

SHA512
74f0e7a364fd771662ca01afee81a2d58ede2475d537747fb9051b37100d9e4dc694f13f0cd54ade5f8255fdaae0c25e79fe3264aedf55d988e8ed2115cd8fb6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe

Filesize
468KB

MD5
f4e54a3c47fa69ed2973475f54aecec9

SHA1
053c9a5763be4b492845817f3eefcec455c244e1

SHA256
a23f51db9cf7c15dab8e0cfd6fdf70ec85c56872f798c4fd1d02373396fb2a8c

SHA512
e610c3589419a661a23daea61db07c85051ca5db011e077d660ad84d33b2d6d7cf9eb62ed6d335ccec2dc81f326c47f2f15d5286b2112381e191fe70ac323d5d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe

Filesize
468KB

MD5
2924ef68629a49c0764d1b22b6b1e754

SHA1
db51402a8ff1eccdbceed7562ce806042321d228

SHA256
9411aac45e9755dd3e48c52e78c017f821afcba283f045e5c222cbd5fba7b89f

SHA512
3facd094f3a3ff37247a3e51ce721d3028ac5bf2fc5ffe1936fc3519500323198bdbfeb8447f8089f38d2ed04529a592ff168f5d00f5c0a4939847e8a9e018b8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe

Filesize
468KB

MD5
127eca7d282086f7fcd13c655220df17

SHA1
8fd438013469d1bd3160723f43efdb60a5210056

SHA256
a2ba481bcc71e8ba3212147a56f3009ca1306e4f1703ab73ccc7df5e8d984b9f

SHA512
ed77e166196ff7e9433294ac594db71250d17e51266ad5ad7f159067fb6db20a910c8a1d1fabf2eae892ec5be35ef9f4209dc6e4892046bfc6980a5985484b70

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44793.exe

Filesize
468KB

MD5
a7de2de8a225dfabedfe336130be49dd

SHA1
a25e390720e43262f75eed88aaf3a724abd445da

SHA256
0a8297f7ff8862309a064c1a6f72748887b7e5537b51a23259ab286d5ad828b4

SHA512
f64d8728aa1d858ad835c56245d3b7659c37aafefd2234e6f1b75404286197ffdfe13425126cd2ef1c404049a7920f7b7431a4a7e026ab51a9921ff684d9685c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe

Filesize
468KB

MD5
77c91ee8b587c5641db1239c683a5d30

SHA1
c15409187371df6a53739940583981cacd55f69d

SHA256
daa47ad6cccb8d804ff290e9e997e2c5ef5bc16e62fa5556a17021e98518809e

SHA512
71b03b8b64fa7e1dbf8cc7739a5029c95c8667be1e9dc18680e6d25ae1a1ea9a671c10c519eddfffd9a7d55ae3843bdc70ff996e467c9f9ff3ef0dfb6d1c9a00

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe

Filesize
468KB

MD5
63642a1b91a8441c212e2afec769b8c9

SHA1
7daee6f5544b58460804a04bafc5be265ba6eb71

SHA256
83e24a32f8cc263fbf2f6cdc77acbbe7505ebea4dc22f577e733f8849bea95b2

SHA512
ff75ff689386706a3b66df83dd3d48116058583e74359d4b418428bb5135ed419fa04bb4546f53144bf33a0773b353a992397b0822d785f097981ba3f5828136

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54999.exe

Filesize
468KB

MD5
31a81b6c9ab2cab76bb04d0da64beb39

SHA1
9aca368a4350171a10ef06cdd6797387e7e528be

SHA256
6f2e252d680872c5b3dd5881721ef24f1dc6c2596c9f1251e6b9bb39e055a35a

SHA512
2906be99a2b359aa523ead72a34cb0ff653f7cf4928f14e65d8c9a70265b862f48bb8423174a08045a88ba5809cbd57b4f204f717ed7d018e05e2c9a9cab1bd9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe

Filesize
468KB

MD5
525d9953af6f47fd298e1c1d8f04f5bb

SHA1
4491d8847ebc2c974621f4d8fc6293316ddd7063

SHA256
aa5e25b200cbcbfc87463f864eb7c51afebd73fba72a251f986940b354a95ccb

SHA512
3b3a2dc62bf3b4e5f60554bc8a981f470b790ce188d602adc6f1868dc322ed37b17f4ca07bc73e9816524815576162bc6a7904413096b92c3129a3bee9873150

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe

Filesize
468KB

MD5
5f9f494e65850c6339e459accd607450

SHA1
ad0cb2292ec527efc718d06b59bd5556a11742bc

SHA256
317ada9b71a4de2f3d45d64eaa9276f7240a7e3554e0962be6f6159a144f0ef5

SHA512
0b328e63dcc64c8f1aa59a089cce4f9d701d2432c025c4cb7039009bc5709ae681b56fbdd6c467b04ed7ed698f81c5b07621dd9c346a6a0a2b145df643aab154

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65145.exe

Filesize
468KB

MD5
c8a8013c747d2fbacbcd0fd479176afa

SHA1
96e13d77956450f899c7234e4ccbd5986124c02b

SHA256
eb5901e6ad451624bdab69a3e8bafaeddb15bf7d2cc280656799f3053937f6cb

SHA512
9708cc4866ac1c46bdf3c11ba45160cf5cecf4b5c73fedb95f9828f2687d251b02fac36bbf74bd14855a0d7e943b722fe69efe640cab04c22e59f94df7f6dd85

Download Submit