6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
Size

468KB
MD5

24bef8dcac295abee43e093972103c30
SHA1

9009a4cebd2c2e60a41b7e72b538d0387eac66db
SHA256

6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40
SHA512

7fe17718b2717dc3d55b7a9d4bba7879002231a84cd89a6d0bc88b0479eab5f4b0ddd1944309892735d52bb74262a1901f373b0b3384c74dd82f1b6d04f88bdd
SSDEEP

3072:aZxCokbrhlJBtbYaPMP1Nf8/fChYpaplnlHCREhyx6XSAVbg+BEd:aZkocjBt1PO1NfaSmpx6iEbg+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2700	Unicorn-42953.exe
2708	Unicorn-4707.exe
2560	Unicorn-301.exe
2116	Unicorn-4458.exe
2596	Unicorn-39762.exe
2568	Unicorn-33631.exe
848	Unicorn-19896.exe
2908	Unicorn-43945.exe
2256	Unicorn-8812.exe
2788	Unicorn-7359.exe
2352	Unicorn-27225.exe
1100	Unicorn-12735.exe
1244	Unicorn-6870.exe
2816	Unicorn-13000.exe
1416	Unicorn-62201.exe
2168	Unicorn-31444.exe
1156	Unicorn-50699.exe
2192	Unicorn-4451.exe
2980	Unicorn-64901.exe
1924	Unicorn-54695.exe
1608	Unicorn-17917.exe
2520	Unicorn-21447.exe
1696	Unicorn-53470.exe
2500	Unicorn-7741.exe
764	Unicorn-7741.exe
1368	Unicorn-36557.exe
776	Unicorn-50293.exe
1264	Unicorn-40087.exe
2296	Unicorn-59054.exe
352	Unicorn-39188.exe
2328	Unicorn-33979.exe
2472	Unicorn-38219.exe
1968	Unicorn-17969.exe
2492	Unicorn-7217.exe
1588	Unicorn-42578.exe
2664	Unicorn-36640.exe
2784	Unicorn-3553.exe
2748	Unicorn-9137.exe
1572	Unicorn-21752.exe
2884	Unicorn-15489.exe
2692	Unicorn-13963.exe
2604	Unicorn-13652.exe
2676	Unicorn-26267.exe
3040	Unicorn-32293.exe
2740	Unicorn-65157.exe
2648	Unicorn-2251.exe
1580	Unicorn-61658.exe
288	Unicorn-14866.exe
960	Unicorn-64259.exe
988	Unicorn-18588.exe
1380	Unicorn-18588.exe
2652	Unicorn-27906.exe
660	Unicorn-47242.exe
332	Unicorn-20892.exe
2972	Unicorn-642.exe
2036	Unicorn-3595.exe
2260	Unicorn-3595.exe
2112	Unicorn-21167.exe
572	Unicorn-12236.exe
2096	Unicorn-20901.exe
2360	Unicorn-4830.exe
840	Unicorn-50532.exe
2040	Unicorn-19884.exe
2940	Unicorn-13045.exe

Loads dropped DLL 64 IoCs

pid	Process
2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
2700	Unicorn-42953.exe
2700	Unicorn-42953.exe
2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
2708	Unicorn-4707.exe
2708	Unicorn-4707.exe
2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
2560	Unicorn-301.exe
2560	Unicorn-301.exe
2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
2700	Unicorn-42953.exe
2700	Unicorn-42953.exe
2116	Unicorn-4458.exe
2116	Unicorn-4458.exe
2708	Unicorn-4707.exe
2708	Unicorn-4707.exe
2560	Unicorn-301.exe
2596	Unicorn-39762.exe
2560	Unicorn-301.exe
2596	Unicorn-39762.exe
2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
2700	Unicorn-42953.exe
2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
2700	Unicorn-42953.exe
848	Unicorn-19896.exe
848	Unicorn-19896.exe
2568	Unicorn-33631.exe
2568	Unicorn-33631.exe
2908	Unicorn-43945.exe
2908	Unicorn-43945.exe
2116	Unicorn-4458.exe
2116	Unicorn-4458.exe
2256	Unicorn-8812.exe
2256	Unicorn-8812.exe
2708	Unicorn-4707.exe
2708	Unicorn-4707.exe
2816	Unicorn-13000.exe
2816	Unicorn-13000.exe
848	Unicorn-19896.exe
848	Unicorn-19896.exe
1244	Unicorn-6870.exe
1244	Unicorn-6870.exe
2700	Unicorn-42953.exe
2700	Unicorn-42953.exe
2788	Unicorn-7359.exe
2352	Unicorn-27225.exe
2788	Unicorn-7359.exe
2352	Unicorn-27225.exe
2596	Unicorn-39762.exe
2560	Unicorn-301.exe
2596	Unicorn-39762.exe
2560	Unicorn-301.exe
1416	Unicorn-62201.exe
1416	Unicorn-62201.exe
2568	Unicorn-33631.exe
1100	Unicorn-12735.exe
1100	Unicorn-12735.exe
2568	Unicorn-33631.exe
2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
2168	Unicorn-31444.exe
2168	Unicorn-31444.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3404	640	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12499.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
2700	Unicorn-42953.exe
2708	Unicorn-4707.exe
2560	Unicorn-301.exe
2116	Unicorn-4458.exe
2596	Unicorn-39762.exe
848	Unicorn-19896.exe
2568	Unicorn-33631.exe
2256	Unicorn-8812.exe
2908	Unicorn-43945.exe
1100	Unicorn-12735.exe
2788	Unicorn-7359.exe
2816	Unicorn-13000.exe
2352	Unicorn-27225.exe
1244	Unicorn-6870.exe
1416	Unicorn-62201.exe
2168	Unicorn-31444.exe
1156	Unicorn-50699.exe
2192	Unicorn-4451.exe
2980	Unicorn-64901.exe
1924	Unicorn-54695.exe
2520	Unicorn-21447.exe
1608	Unicorn-17917.exe
1696	Unicorn-53470.exe
2500	Unicorn-7741.exe
764	Unicorn-7741.exe
776	Unicorn-50293.exe
1264	Unicorn-40087.exe
2296	Unicorn-59054.exe
1368	Unicorn-36557.exe
352	Unicorn-39188.exe
2328	Unicorn-33979.exe
2472	Unicorn-38219.exe
1968	Unicorn-17969.exe
2492	Unicorn-7217.exe
1588	Unicorn-42578.exe
2664	Unicorn-36640.exe
2784	Unicorn-3553.exe
2748	Unicorn-9137.exe
2884	Unicorn-15489.exe
1572	Unicorn-21752.exe
2692	Unicorn-13963.exe
2604	Unicorn-13652.exe
3040	Unicorn-32293.exe
2676	Unicorn-26267.exe
2740	Unicorn-65157.exe
2648	Unicorn-2251.exe
1580	Unicorn-61658.exe
988	Unicorn-18588.exe
1380	Unicorn-18588.exe
288	Unicorn-14866.exe
960	Unicorn-64259.exe
2652	Unicorn-27906.exe
660	Unicorn-47242.exe
332	Unicorn-20892.exe
2972	Unicorn-642.exe
2036	Unicorn-3595.exe
2260	Unicorn-3595.exe
2096	Unicorn-20901.exe
2360	Unicorn-4830.exe
2112	Unicorn-21167.exe
840	Unicorn-50532.exe
572	Unicorn-12236.exe
2040	Unicorn-19884.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2700	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	30
PID 2188 wrote to memory of 2700	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	30
PID 2188 wrote to memory of 2700	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	30
PID 2188 wrote to memory of 2700	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	30
PID 2700 wrote to memory of 2708	2700	Unicorn-42953.exe	31
PID 2700 wrote to memory of 2708	2700	Unicorn-42953.exe	31
PID 2700 wrote to memory of 2708	2700	Unicorn-42953.exe	31
PID 2700 wrote to memory of 2708	2700	Unicorn-42953.exe	31
PID 2188 wrote to memory of 2560	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	32
PID 2188 wrote to memory of 2560	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	32
PID 2188 wrote to memory of 2560	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	32
PID 2188 wrote to memory of 2560	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	32
PID 2708 wrote to memory of 2116	2708	Unicorn-4707.exe	33
PID 2708 wrote to memory of 2116	2708	Unicorn-4707.exe	33
PID 2708 wrote to memory of 2116	2708	Unicorn-4707.exe	33
PID 2708 wrote to memory of 2116	2708	Unicorn-4707.exe	33
PID 2560 wrote to memory of 2596	2560	Unicorn-301.exe	35
PID 2560 wrote to memory of 2596	2560	Unicorn-301.exe	35
PID 2560 wrote to memory of 2596	2560	Unicorn-301.exe	35
PID 2560 wrote to memory of 2596	2560	Unicorn-301.exe	35
PID 2188 wrote to memory of 2568	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	34
PID 2188 wrote to memory of 2568	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	34
PID 2188 wrote to memory of 2568	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	34
PID 2188 wrote to memory of 2568	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	34
PID 2700 wrote to memory of 848	2700	Unicorn-42953.exe	36
PID 2700 wrote to memory of 848	2700	Unicorn-42953.exe	36
PID 2700 wrote to memory of 848	2700	Unicorn-42953.exe	36
PID 2700 wrote to memory of 848	2700	Unicorn-42953.exe	36
PID 2116 wrote to memory of 2908	2116	Unicorn-4458.exe	37
PID 2116 wrote to memory of 2908	2116	Unicorn-4458.exe	37
PID 2116 wrote to memory of 2908	2116	Unicorn-4458.exe	37
PID 2116 wrote to memory of 2908	2116	Unicorn-4458.exe	37
PID 2708 wrote to memory of 2256	2708	Unicorn-4707.exe	38
PID 2708 wrote to memory of 2256	2708	Unicorn-4707.exe	38
PID 2708 wrote to memory of 2256	2708	Unicorn-4707.exe	38
PID 2708 wrote to memory of 2256	2708	Unicorn-4707.exe	38
PID 2560 wrote to memory of 2788	2560	Unicorn-301.exe	39
PID 2560 wrote to memory of 2788	2560	Unicorn-301.exe	39
PID 2560 wrote to memory of 2788	2560	Unicorn-301.exe	39
PID 2560 wrote to memory of 2788	2560	Unicorn-301.exe	39
PID 2596 wrote to memory of 2352	2596	Unicorn-39762.exe	40
PID 2596 wrote to memory of 2352	2596	Unicorn-39762.exe	40
PID 2596 wrote to memory of 2352	2596	Unicorn-39762.exe	40
PID 2596 wrote to memory of 2352	2596	Unicorn-39762.exe	40
PID 2188 wrote to memory of 1100	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	41
PID 2188 wrote to memory of 1100	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	41
PID 2188 wrote to memory of 1100	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	41
PID 2188 wrote to memory of 1100	2188	6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe	41
PID 2700 wrote to memory of 1244	2700	Unicorn-42953.exe	42
PID 2700 wrote to memory of 1244	2700	Unicorn-42953.exe	42
PID 2700 wrote to memory of 1244	2700	Unicorn-42953.exe	42
PID 2700 wrote to memory of 1244	2700	Unicorn-42953.exe	42
PID 848 wrote to memory of 2816	848	Unicorn-19896.exe	43
PID 848 wrote to memory of 2816	848	Unicorn-19896.exe	43
PID 848 wrote to memory of 2816	848	Unicorn-19896.exe	43
PID 848 wrote to memory of 2816	848	Unicorn-19896.exe	43
PID 2568 wrote to memory of 1416	2568	Unicorn-33631.exe	44
PID 2568 wrote to memory of 1416	2568	Unicorn-33631.exe	44
PID 2568 wrote to memory of 1416	2568	Unicorn-33631.exe	44
PID 2568 wrote to memory of 1416	2568	Unicorn-33631.exe	44
PID 2908 wrote to memory of 2168	2908	Unicorn-43945.exe	45
PID 2908 wrote to memory of 2168	2908	Unicorn-43945.exe	45
PID 2908 wrote to memory of 2168	2908	Unicorn-43945.exe	45
PID 2908 wrote to memory of 2168	2908	Unicorn-43945.exe	45

C:\Users\Admin\AppData\Local\Temp\6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe
"C:\Users\Admin\AppData\Local\Temp\6021f0f5ceac6ba2208bcb2379f80786acb4446244517f9f701c02358b405f40N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4707.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4458.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe
        8⤵
        Executes dropped EXE
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19012.exe
        9⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        9⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        9⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        9⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        8⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        8⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        8⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        8⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        7⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
        7⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 236
        8⤵
        Program crash
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10516.exe
        7⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        7⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55540.exe
        6⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
        7⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        7⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50651.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30617.exe
        7⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        8⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        8⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        8⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        8⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20061.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        6⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        7⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        7⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36640.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        7⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        5⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29654.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        5⤵
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39064.exe
        8⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
        8⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        8⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
        7⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44384.exe
        6⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46910.exe
        7⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        7⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        6⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        6⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exe
        7⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        7⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        6⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60750.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        6⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60407.exe
        5⤵
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52464.exe
        6⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        7⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        7⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21161.exe
        5⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        6⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54542.exe
        5⤵
        
        PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        5⤵
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62478.exe
        6⤵
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
      4⤵
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        5⤵
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35206.exe
      4⤵
      PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43466.exe
        7⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        8⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22178.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25904.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        7⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9984.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22178.exe
        7⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
        5⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45493.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32293.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        6⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        5⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        6⤵
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61400.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
      4⤵
      PID:1372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6870.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21447.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46889.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10988.exe
        5⤵
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        5⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24739.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7210.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        5⤵
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exe
      4⤵
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26487.exe
        5⤵
        
        PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
      4⤵
      PID:4692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
        5⤵
        
        PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55275.exe
      4⤵
      PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
      4⤵
      PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46889.exe
      4⤵
      PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
      4⤵
      PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exe
    3⤵
    PID:2680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-301.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-301.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10321.exe
        7⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        8⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
        8⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        7⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2786.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10775.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        6⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4919.exe
        6⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49310.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        7⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41495.exe
        6⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48073.exe
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
        5⤵
        
        PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21167.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        6⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52179.exe
        5⤵
        
        PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10775.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        5⤵
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
        5⤵
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        6⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30253.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61131.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35914.exe
        7⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        6⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63305.exe
        5⤵
        
        PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10775.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        5⤵
        
        PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
      4⤵
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        5⤵
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
      4⤵
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13652.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2770.exe
        6⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        7⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        6⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        6⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31830.exe
        5⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50530.exe
        6⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        5⤵
        
        PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
      4⤵
      PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
      4⤵
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50293.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-485.exe
        5⤵
        
        PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        5⤵
        
        PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
      4⤵
      PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
      4⤵
      PID:5828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20901.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5111.exe
      4⤵
      PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
      4⤵
      PID:5316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56977.exe
    3⤵
    PID:3812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7059.exe
    3⤵
    PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12113.exe
    3⤵
    PID:5152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40087.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-757.exe
        5⤵
        
        PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
        5⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-644.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
      4⤵
      PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29517.exe
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        5⤵
        
        PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14202.exe
      4⤵
      PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
      4⤵
      PID:5396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47242.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43466.exe
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
      4⤵
      PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
    3⤵
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62612.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33829.exe
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
    3⤵
    PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        5⤵
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
      4⤵
      PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65293.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
      4⤵
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
      4⤵
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
      4⤵
      PID:5992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
    3⤵
    PID:4688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18588.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
      4⤵
      PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
      4⤵
      PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20061.exe
    3⤵
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35914.exe
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1849.exe
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
    3⤵
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
    3⤵
    PID:5332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45853.exe
    3⤵
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
      4⤵
      PID:5692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
    3⤵
    PID:5708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58724.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58724.exe
  2⤵
  PID:2252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
    3⤵
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
    3⤵
    PID:5640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43585.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43585.exe
  2⤵
  PID:3152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19157.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19157.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
  2⤵
  PID:4872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
  2⤵
  PID:5472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe

Filesize
468KB

MD5
2c9f49a016aa6395cca1e2bbb2ae3347

SHA1
e8bb5aba7e14c580d272944adfa15b1edab8ef62

SHA256
344852a1a070c5e3f78c8af117925434cab12c632ca72dff178ac7e5f8b32d7e

SHA512
640922f24a70eb01449983145b38f9cee7f790ef5bb7db3f71b9ae4e344513faf3166e0267fd6f7486a119d077800b68bf9175fcbd033dcfe49aae52985eb8ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe

Filesize
468KB

MD5
59539077343a30b790d4b58f70d65e42

SHA1
c69e8593b91ccbec3a60c0c05503bf21c3971282

SHA256
63d3a969c836c8604fe6d6dd2f93fd9431c8bc30a1ca3934dcef5a5a7ffd6efb

SHA512
f88290b191c3aa7f14e9a55a516f5d6d7e009657feb79be846c4cb33364462a408952cc7b2afb61589d82aa3f97e29bba7fafe5e481c18de192386449d03a880

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe

Filesize
468KB

MD5
5b81d9a4ef6847472156dbb0e1219042

SHA1
2a25b2f731eb43996cce1a026bee9867176bd8a2

SHA256
f24ab3024de09240c9ef33c2d6b0d5cf43434a30f2a2ffcc0f83d85c4eb1dcf2

SHA512
1a234da5cbfcf5cb185460ab9c1c9476283e8a9242b69e3a965c00a98db010eb95920e8b0863b2bc1c9d3fb24145b66dda6158863847bd35b007c11929a0ccd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-301.exe

Filesize
468KB

MD5
0075442583dbb0c3dd5a3b1605506e12

SHA1
1e66ab48bb70407d9b08f6c4b341c7de7fe3c724

SHA256
a6fc11ab4751cfb9a1ce9bf3ea2a8e1835151b0ad2be85ca66d63dd2d3c6231e

SHA512
5a10c89d94a298baeeff108cb91251827ed4259d75d47461f0897facf891a75979ad3112f17d778d0986bca88f507f44a709797ddc6ed5f8bbd6f5376dc0d6c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe

Filesize
468KB

MD5
b80c6f5bebf613daa031d8d6aca8cb3a

SHA1
b3077f9b9e0375010c4dc8e61ba9eddd6b59ef45

SHA256
012cb8bb929215c19a081fdf1e100d11045db2d9db0c368b92102e31581369fc

SHA512
ea5fe47b434e3f173636f4bab22c63057aa7e16d4ed6c27f280195cf3d852e39746c39d9b72d56dd4958d7f92a6a09753a9c418f8259d066081088bed3bfe8f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe

Filesize
468KB

MD5
a08b2557c96e8d4f118417ec4ec7041f

SHA1
fbd2371563fc19f7747f151fd3eb9fa0a4855509

SHA256
e95f3559f306421c1f4c947fe0d0fd25b3577b963d9909fcb08b9c922fe66376

SHA512
a69a022d8516bed63adf426739cf94f4bfa0053165ad3c04e4736b3c9047ab3164bb65492efd815cddd74c462319134ac47e4273510522ff56cd2f09f9e550da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe

Filesize
468KB

MD5
96e3fafeeff0dc3362dcfed5921d4fc0

SHA1
ff5b0c9cc8035cc69408b41319679498d998c61d

SHA256
fb3ebd146960d8fa7cbad82dd87c9fb60f18b0157c448854f6e4f4a7e1ce5fee

SHA512
40f6b7dc23274743185a1ea10606cdcfdd8f35dbab4d2126d2ed6ec152b5c9349277381b7b6c307d794ef4e3547d55ca4b470bcd9f1592ca9b3f162aa556c268

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4458.exe

Filesize
468KB

MD5
bd5c9ce79b87272497e0c029d841ce8c

SHA1
9fc768125867ba55acab9668ef7e3f348392ce96

SHA256
4db052aa81304526441914dace0a2b524bc6ece0334a040355fcdc7691be1031

SHA512
b89cccd9ff3ec9437af7827978cdde2cdb04e080cb34e5e9a441ed77cd9beff790b7244960757c1c978bc90031c661604f37c3f33ca53dff1c42a0c941c8b19d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe

Filesize
468KB

MD5
8030a65006c8ba56bd1b3965a6d2b9a0

SHA1
e83d9edf3a6bf79a32dec63b3926ebb0fcac8de6

SHA256
ca5001d787ad4a1fdbcb082d345b5adde0802e6332faa65d96ddf7ce67206048

SHA512
6adabec487e0db77a057ab463b8ed6c9f358479c9e8e4fd1b99c365fc11edfe1324f8f651e0d2d440296437611ca2ed0efcbeee1e9d138a6462f716c3ce313e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe

Filesize
468KB

MD5
50932ab9b39e050730f13e9c39b01cf3

SHA1
7943266b23d63402bfbd5f695f80a779f365c5c0

SHA256
6470e5a3a5ab65795955e508bbb73d7333e5946a231d07a6a19e2291e6baa80f

SHA512
4a01e533748291be3f59e66f7822484f1503f8cc6de50972647cc10a0e3d31dfd0967cf73a28cbad3ed92fa81828358bd043d41ca1d673250be2a38ec501cf9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe

Filesize
468KB

MD5
e6645976192b23405fb490d13fd7c1b8

SHA1
73c13ca76b7107918b79e81a3446fc1fd4b86c2c

SHA256
337d178d3516470420b144ef99fa5d79de05062a440d7f76e121c13082b9f9d5

SHA512
37a590dbc28b41fe72ac9ea851ef0ee7b253f5abac28636a07f696f85c4e3728007271897a6afbc49edc6f8e0906031d2ab100392bc5232e8e90c37fd8917525

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe

Filesize
468KB

MD5
40d4086208fe39535edebf9f3768c198

SHA1
32e3e95fe0d94faf6688d8bf7560ad4a09040722

SHA256
4624a2cc7decf4c1575f9af9132e79888eb6248e266ce8e68d4fcf395197880f

SHA512
96cb04ecf7929113e3a84869712e985397841ee348be05fe44cf67ef103724065dc3e984f775e827d0f25edfcbe0abdc8d10273a0416c3cde3af592fdb5ccbd5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe

Filesize
468KB

MD5
f8357ebf825da9fc40e104e2a532ddc9

SHA1
3e67c465fdfe6a6c4f6104e0ab4e0b217ed5209f

SHA256
882929c111d0cf0d3e1a4dc18b9903ed16b93ca686f38c8f61aed6f02f60b30c

SHA512
467e4856b5241811ae38207d53095d802d827bdfd52df942a3caa52d9def70e1cc847f540cfe110c9294cc3869a52aeac848bf4765344848dd6755ee3852bcac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe

Filesize
468KB

MD5
feeea01be424133c944b444c0e740827

SHA1
3be4cb9c83552f20b0c6b9fa187950934b58560e

SHA256
9634723103a43149542de6908ee3f5df3b06d85b159656945f6bad7f9a65fc29

SHA512
7756b9ae343a45b42005391fb014de39ee72c6a5d5de2ef92275ba27696870f7f1abd0e4dd28832a1a7669bfc4833c170954c3ed9044705a2219e4c2b6ec0265

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe

Filesize
468KB

MD5
3bd8b421c92fde93ff6af77d4f11457c

SHA1
1a5e2978834916284e5d03053ba64b56a7fe8c5f

SHA256
45bf58bf46609a956f245cd14bcdabfb16700a48d92065c43522717b0cf534d6

SHA512
956be2316b85b56b25b7d2e421c19f5d130b3e357aea7b76f7430829c3ed4d431321e95f957fb6aa741096973f5425f9cb9ed439ad58caecb401c51fe25d888b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe

Filesize
468KB

MD5
8c3169caa11f5896bbc6fe18e782753e

SHA1
1ea96d110860571c1604bdf27a7098d20965a0de

SHA256
b2cd1885e9d4519cca46ccd02c564dab8b381ccc0d2cc6b063b4ef950844af35

SHA512
d7019c082345f6a8fa2b4e614a5656a3689be6495f04bcd7e61e7134bc79ade26d632c174c180e846c00014f760b990993cbc22ddfbed99962cc610f6641f886

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4707.exe

Filesize
468KB

MD5
d4481f265b2cb58aa2738aaa036c2d30

SHA1
78a59fcb0b731dd7559bb6dfe34b23bc89683251

SHA256
5cecdf1e0b796d00f7d9f968a555986640bd3c861bcdceca586d5b331c96cf81

SHA512
7de878437c0598f3a8129afe11876eec4f1341fada024414c9fe2855121ace730c7a7a6efcc7b2194b44975dc19e50f8d040c941db0f34e4b5513c46cbb0f0f3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe

Filesize
468KB

MD5
7efa1bd46d9b8fd9f5b09634a8ccb662

SHA1
f4e7435197244d9f24f1c65ef3ed4a0a8b45a849

SHA256
6e0b9bd558405313028b9502488a33556656e33530b2abbe3f79ab9fe5359fb6

SHA512
36f0db093fc8f531be139786ba89835f63bcfcf6d12a679de414bcc6c195e084f7b9ce8aa86c0e6abb822d507736a3e8ace57f7c541ec8a39182d80cf85ef22a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe

Filesize
468KB

MD5
7685f574dbd9d8763231f3a13f47aa5f

SHA1
e2ca9720d0b0ab8d4727e997092699bd92be9f67

SHA256
8abeb4072601d161d1d6105a07a8e6e6991329b1bc4c04e3b8f9c7dba8c0a694

SHA512
80771799016904edfae2d4b4ab9158d9772c2413ec2ba5f20a96f7a45db64e25af3252980a7e8f4533435bd66511a2804de08a916731aa1f2bc76f3272238b4d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6870.exe

Filesize
468KB

MD5
c9f99063ee1e23fbbb6710c43e7668e2

SHA1
8f3af3b4a0a0368bd80ffb54509ec2e8fa1ab842

SHA256
90df225f352340d0b3a53befd9b069031ef77862dc6ed7f29b3df7dda3084edd

SHA512
fac05e44611dafadb23eba2cee606f31bdbed857300521b3d1cf22e410ce6e9104f3e530e4558cfd31b743b764141527df49d9385d1a9d3509db0a8f5b28e872

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe

Filesize
468KB

MD5
7afd0b9df31bc2eeea4c45cf10f25b4d

SHA1
76a0bece53295052d83cc069f58be3310ca70227

SHA256
842c06cb8170df0a486b38324d56230c33155af4304055fc02d41be8e67f94d6

SHA512
f8da0186acd8eafb9cedcbe99d881dc1130212bfc41154e6a7f5b9b9484bf59b26863c3aa5f26aab99332d0360a6745a6edaf00deb507ea12271d9c02578dffc

Download Submit