9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1

Analysis

max time kernel
113s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
Size

468KB
MD5

c6d40901aa72dbf9f448f52ec2d29b40
SHA1

58bd3ae9dccc4fb2f5714d12000296116b59814f
SHA256

9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1
SHA512

c25a57f945b846b84151c7930ff254bcee16db55e95e7b73c6f53c6d5cee294070a186cb1f024c43b307a9f08f9a93fa11299dc577ecbac72f434721c6d1a1e6
SSDEEP

3072:6JACo3lwI03YtbYgPzcYNfT/rChaxIpQn1HCOVQtNijLrwjNSulK:6J1oROYt7P4YNfx0nJNin0jNS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2400	Unicorn-27683.exe
900	Unicorn-5809.exe
2356	Unicorn-18616.exe
2888	Unicorn-42185.exe
2752	Unicorn-56445.exe
2772	Unicorn-52391.exe
2872	Unicorn-9320.exe
2684	Unicorn-25600.exe
2484	Unicorn-26013.exe
1632	Unicorn-15615.exe
2920	Unicorn-47831.exe
2972	Unicorn-27161.exe
2000	Unicorn-48096.exe
1808	Unicorn-28230.exe
1996	Unicorn-29399.exe
2576	Unicorn-28365.exe
484	Unicorn-28173.exe
2100	Unicorn-48039.exe
1232	Unicorn-54297.exe
680	Unicorn-7857.exe
824	Unicorn-20664.exe
3024	Unicorn-7665.exe
948	Unicorn-56674.exe
2304	Unicorn-35355.exe
1468	Unicorn-38693.exe
1576	Unicorn-82.exe
892	Unicorn-56290.exe
1264	Unicorn-16911.exe
756	Unicorn-62435.exe
3052	Unicorn-60198.exe
1552	Unicorn-39948.exe
2316	Unicorn-59814.exe
1932	Unicorn-36471.exe
1012	Unicorn-11848.exe
2524	Unicorn-8127.exe
2244	Unicorn-44329.exe
1804	Unicorn-44329.exe
2740	Unicorn-21478.exe
2844	Unicorn-34137.exe
2896	Unicorn-43561.exe
2808	Unicorn-56560.exe
2960	Unicorn-30105.exe
2608	Unicorn-8786.exe
1960	Unicorn-28652.exe
996	Unicorn-57603.exe
2656	Unicorn-11931.exe
272	Unicorn-36829.exe
2004	Unicorn-11547.exe
804	Unicorn-27884.exe
2924	Unicorn-43378.exe
1388	Unicorn-61791.exe
2956	Unicorn-28662.exe
1540	Unicorn-45263.exe
1668	Unicorn-2693.exe
3064	Unicorn-22028.exe
1396	Unicorn-28159.exe
3020	Unicorn-12014.exe
1776	Unicorn-5792.exe
408	Unicorn-34822.exe
1308	Unicorn-26016.exe
1204	Unicorn-5766.exe
2396	Unicorn-25632.exe
1580	Unicorn-5853.exe
2256	Unicorn-28512.exe

Loads dropped DLL 64 IoCs

pid	Process
1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
2400	Unicorn-27683.exe
2400	Unicorn-27683.exe
1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
900	Unicorn-5809.exe
900	Unicorn-5809.exe
2400	Unicorn-27683.exe
2400	Unicorn-27683.exe
1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
2356	Unicorn-18616.exe
2356	Unicorn-18616.exe
2752	Unicorn-56445.exe
2752	Unicorn-56445.exe
2400	Unicorn-27683.exe
2400	Unicorn-27683.exe
2888	Unicorn-42185.exe
2888	Unicorn-42185.exe
1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
2356	Unicorn-18616.exe
1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
900	Unicorn-5809.exe
900	Unicorn-5809.exe
2356	Unicorn-18616.exe
2872	Unicorn-9320.exe
2872	Unicorn-9320.exe
2684	Unicorn-25600.exe
2684	Unicorn-25600.exe
2752	Unicorn-56445.exe
2752	Unicorn-56445.exe
2772	Unicorn-52391.exe
2484	Unicorn-26013.exe
2772	Unicorn-52391.exe
2484	Unicorn-26013.exe
2400	Unicorn-27683.exe
2400	Unicorn-27683.exe
1632	Unicorn-15615.exe
1632	Unicorn-15615.exe
2888	Unicorn-42185.exe
2888	Unicorn-42185.exe
2000	Unicorn-48096.exe
2000	Unicorn-48096.exe
1808	Unicorn-28230.exe
1808	Unicorn-28230.exe
2872	Unicorn-9320.exe
2972	Unicorn-27161.exe
2872	Unicorn-9320.exe
2972	Unicorn-27161.exe
900	Unicorn-5809.exe
900	Unicorn-5809.exe
2920	Unicorn-47831.exe
2920	Unicorn-47831.exe
2356	Unicorn-18616.exe
2356	Unicorn-18616.exe
1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
1996	Unicorn-29399.exe
1996	Unicorn-29399.exe
2684	Unicorn-25600.exe
2576	Unicorn-28365.exe
2684	Unicorn-25600.exe
2576	Unicorn-28365.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2736	1996	WerFault.exe	44
2300	1960	WerFault.exe	74
1944	3052	WerFault.exe	60
3580	1204	WerFault.exe	91
4028	1308	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49608.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
2400	Unicorn-27683.exe
900	Unicorn-5809.exe
2356	Unicorn-18616.exe
2888	Unicorn-42185.exe
2752	Unicorn-56445.exe
2772	Unicorn-52391.exe
2872	Unicorn-9320.exe
2684	Unicorn-25600.exe
2484	Unicorn-26013.exe
1632	Unicorn-15615.exe
2000	Unicorn-48096.exe
2972	Unicorn-27161.exe
2920	Unicorn-47831.exe
1808	Unicorn-28230.exe
1996	Unicorn-29399.exe
2576	Unicorn-28365.exe
2100	Unicorn-48039.exe
484	Unicorn-28173.exe
1232	Unicorn-54297.exe
680	Unicorn-7857.exe
824	Unicorn-20664.exe
3024	Unicorn-7665.exe
948	Unicorn-56674.exe
2304	Unicorn-35355.exe
1468	Unicorn-38693.exe
892	Unicorn-56290.exe
1576	Unicorn-82.exe
756	Unicorn-62435.exe
1264	Unicorn-16911.exe
3052	Unicorn-60198.exe
1552	Unicorn-39948.exe
2316	Unicorn-59814.exe
1932	Unicorn-36471.exe
1012	Unicorn-11848.exe
1804	Unicorn-44329.exe
2524	Unicorn-8127.exe
2740	Unicorn-21478.exe
2244	Unicorn-44329.exe
2844	Unicorn-34137.exe
2896	Unicorn-43561.exe
2808	Unicorn-56560.exe
2960	Unicorn-30105.exe
2608	Unicorn-8786.exe
804	Unicorn-27884.exe
1960	Unicorn-28652.exe
996	Unicorn-57603.exe
2656	Unicorn-11931.exe
272	Unicorn-36829.exe
2004	Unicorn-11547.exe
2924	Unicorn-43378.exe
1388	Unicorn-61791.exe
2956	Unicorn-28662.exe
1540	Unicorn-45263.exe
3064	Unicorn-22028.exe
1668	Unicorn-2693.exe
1396	Unicorn-28159.exe
3020	Unicorn-12014.exe
1776	Unicorn-5792.exe
408	Unicorn-34822.exe
1308	Unicorn-26016.exe
1580	Unicorn-5853.exe
2396	Unicorn-25632.exe
2268	Unicorn-28512.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2400	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	30
PID 1964 wrote to memory of 2400	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	30
PID 1964 wrote to memory of 2400	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	30
PID 1964 wrote to memory of 2400	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	30
PID 2400 wrote to memory of 900	2400	Unicorn-27683.exe	31
PID 2400 wrote to memory of 900	2400	Unicorn-27683.exe	31
PID 2400 wrote to memory of 900	2400	Unicorn-27683.exe	31
PID 2400 wrote to memory of 900	2400	Unicorn-27683.exe	31
PID 1964 wrote to memory of 2356	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	32
PID 1964 wrote to memory of 2356	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	32
PID 1964 wrote to memory of 2356	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	32
PID 1964 wrote to memory of 2356	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	32
PID 900 wrote to memory of 2888	900	Unicorn-5809.exe	33
PID 900 wrote to memory of 2888	900	Unicorn-5809.exe	33
PID 900 wrote to memory of 2888	900	Unicorn-5809.exe	33
PID 900 wrote to memory of 2888	900	Unicorn-5809.exe	33
PID 2400 wrote to memory of 2752	2400	Unicorn-27683.exe	34
PID 2400 wrote to memory of 2752	2400	Unicorn-27683.exe	34
PID 2400 wrote to memory of 2752	2400	Unicorn-27683.exe	34
PID 2400 wrote to memory of 2752	2400	Unicorn-27683.exe	34
PID 1964 wrote to memory of 2772	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	35
PID 1964 wrote to memory of 2772	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	35
PID 1964 wrote to memory of 2772	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	35
PID 1964 wrote to memory of 2772	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	35
PID 2356 wrote to memory of 2872	2356	Unicorn-18616.exe	36
PID 2356 wrote to memory of 2872	2356	Unicorn-18616.exe	36
PID 2356 wrote to memory of 2872	2356	Unicorn-18616.exe	36
PID 2356 wrote to memory of 2872	2356	Unicorn-18616.exe	36
PID 2752 wrote to memory of 2684	2752	Unicorn-56445.exe	37
PID 2752 wrote to memory of 2684	2752	Unicorn-56445.exe	37
PID 2752 wrote to memory of 2684	2752	Unicorn-56445.exe	37
PID 2752 wrote to memory of 2684	2752	Unicorn-56445.exe	37
PID 2400 wrote to memory of 2484	2400	Unicorn-27683.exe	38
PID 2400 wrote to memory of 2484	2400	Unicorn-27683.exe	38
PID 2400 wrote to memory of 2484	2400	Unicorn-27683.exe	38
PID 2400 wrote to memory of 2484	2400	Unicorn-27683.exe	38
PID 2888 wrote to memory of 1632	2888	Unicorn-42185.exe	39
PID 2888 wrote to memory of 1632	2888	Unicorn-42185.exe	39
PID 2888 wrote to memory of 1632	2888	Unicorn-42185.exe	39
PID 2888 wrote to memory of 1632	2888	Unicorn-42185.exe	39
PID 1964 wrote to memory of 2920	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	40
PID 1964 wrote to memory of 2920	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	40
PID 1964 wrote to memory of 2920	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	40
PID 1964 wrote to memory of 2920	1964	9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe	40
PID 900 wrote to memory of 1808	900	Unicorn-5809.exe	42
PID 900 wrote to memory of 1808	900	Unicorn-5809.exe	42
PID 900 wrote to memory of 1808	900	Unicorn-5809.exe	42
PID 900 wrote to memory of 1808	900	Unicorn-5809.exe	42
PID 2356 wrote to memory of 2972	2356	Unicorn-18616.exe	41
PID 2356 wrote to memory of 2972	2356	Unicorn-18616.exe	41
PID 2356 wrote to memory of 2972	2356	Unicorn-18616.exe	41
PID 2356 wrote to memory of 2972	2356	Unicorn-18616.exe	41
PID 2872 wrote to memory of 2000	2872	Unicorn-9320.exe	43
PID 2872 wrote to memory of 2000	2872	Unicorn-9320.exe	43
PID 2872 wrote to memory of 2000	2872	Unicorn-9320.exe	43
PID 2872 wrote to memory of 2000	2872	Unicorn-9320.exe	43
PID 2684 wrote to memory of 1996	2684	Unicorn-25600.exe	44
PID 2684 wrote to memory of 1996	2684	Unicorn-25600.exe	44
PID 2684 wrote to memory of 1996	2684	Unicorn-25600.exe	44
PID 2684 wrote to memory of 1996	2684	Unicorn-25600.exe	44
PID 2752 wrote to memory of 2576	2752	Unicorn-56445.exe	45
PID 2752 wrote to memory of 2576	2752	Unicorn-56445.exe	45
PID 2752 wrote to memory of 2576	2752	Unicorn-56445.exe	45
PID 2752 wrote to memory of 2576	2752	Unicorn-56445.exe	45

C:\Users\Admin\AppData\Local\Temp\9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe
"C:\Users\Admin\AppData\Local\Temp\9375ec09a1b828e1b25b51d74b3ae07b20300347afe97725a8a27610876f70a1N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27683.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27683.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15615.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        8⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        9⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        9⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        9⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        8⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        8⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        8⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
        8⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        7⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-711.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13640.exe
        7⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7117.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        7⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        7⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9616.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39448.exe
        6⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        6⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56356.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65066.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47371.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58976.exe
        7⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        7⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32320.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        6⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42261.exe
        5⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56674.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11547.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
        7⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        8⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1393.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61452.exe
        7⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9616.exe
        7⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
        6⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43378.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26127.exe
        6⤵
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48154.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        5⤵
        
        PID:656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        6⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62135.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42397.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5147.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44104.exe
        5⤵
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41530.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38729.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28662.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42397.exe
        5⤵
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
        5⤵
        
        PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        5⤵
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
      4⤵
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17254.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
        5⤵
        
        PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25600.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        8⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 236
        8⤵
        Program crash
        
        PID:4028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 236
        7⤵
        Program crash
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        6⤵
        Executes dropped EXE
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        7⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 236
        7⤵
        Program crash
        
        PID:3580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 240
        6⤵
        Program crash
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25632.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        7⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        6⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65066.exe
        6⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        7⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14005.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55621.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27102.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5853.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        6⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29390.exe
        6⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9284.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26865.exe
        5⤵
        
        PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40822.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-754.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28365.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        6⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exe
        7⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
        7⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20846.exe
        7⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23512.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38199.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
        5⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        6⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56370.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42289.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54535.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
        5⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        5⤵
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41125.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        7⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59590.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36934.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        5⤵
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59959.exe
      4⤵
      PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28384.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
      4⤵
      PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54149.exe
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
      4⤵
      PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62360.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exe
        6⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42769.exe
        5⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
        6⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53023.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47126.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37454.exe
        5⤵
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
        5⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37199.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
      4⤵
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24597.exe
        5⤵
        
        PID:600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37192.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
        6⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
      4⤵
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
      4⤵
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8701.exe
        5⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        6⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54820.exe
        5⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65066.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        5⤵
        
        PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4404.exe
      4⤵
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
      4⤵
      PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
      4⤵
      PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60059.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        5⤵
        
        PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
      4⤵
      PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46224.exe
      4⤵
      PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58656.exe
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10500.exe
      4⤵
      PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
    3⤵
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
      4⤵
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3158.exe
      4⤵
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
      4⤵
      PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
      4⤵
      PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe
    3⤵
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
    3⤵
    PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7665.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43561.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
        7⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13640.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
        7⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        6⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9616.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
        7⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        6⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33673.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
        6⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        7⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58425.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        6⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62135.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61791.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        7⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        6⤵
        
        PID:276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        5⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54149.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22028.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43377.exe
        5⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47547.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        6⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41467.exe
      4⤵
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33754.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13326.exe
        5⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19593.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26115.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
      4⤵
      PID:5864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28652.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 200
        6⤵
        Program crash
        
        PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        5⤵
        
        PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49129.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57603.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
        6⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
        6⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23512.exe
        5⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
        5⤵
        
        PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
        5⤵
        
        PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
      4⤵
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
      4⤵
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
      4⤵
      PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40518.exe
        5⤵
        
        PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
      4⤵
      PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19072.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
      4⤵
      PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34822.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
      4⤵
      PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
      4⤵
      PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50770.exe
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40019.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19291.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
    3⤵
    PID:5484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28173.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe
        5⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62934.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        6⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
      4⤵
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46489.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        5⤵
        
        PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
      4⤵
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
      4⤵
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        5⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37863.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exe
        5⤵
        
        PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20846.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24117.exe
      4⤵
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4311.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
    3⤵
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64171.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
      4⤵
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31587.exe
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28972.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11007.exe
    3⤵
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
    3⤵
    PID:5196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56290.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        5⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9967.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exe
        5⤵
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
      4⤵
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45581.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        5⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        5⤵
        
        PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
      4⤵
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
      4⤵
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11644.exe
      4⤵
      PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58817.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
      4⤵
      PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
    3⤵
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
    3⤵
    PID:3440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
    3⤵
    PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
    3⤵
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
    3⤵
    PID:5668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
      4⤵
      PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
    3⤵
    PID:4000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
    3⤵
    PID:4376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe
    3⤵
    PID:5844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
    3⤵
    PID:1900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
    3⤵
    PID:3860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
    3⤵
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
    3⤵
    PID:5996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
  2⤵
  PID:1176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
  2⤵
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37420.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37420.exe
  2⤵
  PID:5524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-15615.exe

Filesize
468KB

MD5
8706f0b6247fe024fa00d6cff0f12aac

SHA1
002ec72be4961737e64877d2861dd4637db5908a

SHA256
30798c15cdecef8476bc4918dbdfd5785f035c4ee89bdda04993387135753802

SHA512
676bf59e2bf50c4b8ef82c7b1cf57fb5a3deaf1a2795559ec9f87d351486a85d51a7d1dc131e04d6f3b291025595fba0e0052acf93a6323bf6227d0e775987f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe

Filesize
468KB

MD5
87e260eac10df0b7210a10e4b1538af8

SHA1
d722af5e340a40dc00784568870a0f1976e1dab7

SHA256
44bc8d53f5c817b4852babc990ac91449e7f94d750443b9584047a25ee0287f1

SHA512
5d996a60e35b5407423cea5c8cea2b231739eca2c1793619633a7b6d0264432d8fa74a306d837327a38dad85260e0304b1b98f27b7bd01d63b0495c370b2c5a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe

Filesize
468KB

MD5
44f58954e76d7d7df0f885591178242c

SHA1
9b25f9da97c363893f680b30da082a545c127628

SHA256
6e8729d0cae3e745e4475597557432101d0a60c8fc5ecdc9e9b7a8a56dd385bd

SHA512
eca1a28a0751b6e577ed3854a27f6d5c0f60425802cba2f7f9fe98e5d8df210c1d9874ffe5ab295cbf18a87e4056d802f0a139cf14fb8c4693bbf157b5d21ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe

Filesize
468KB

MD5
f3df423e9b5d08f5bec9964f2f6d39b5

SHA1
a7f29ded6c09a9f3c1d274636494f5f7cff99ac4

SHA256
41ebcbb90160e9607328ce17b0db44016ba94cfef4e843fa7a25e0d254c7402a

SHA512
632419c822915434bc62dfa37e7f65c483643f608402fb26790eb83b10735b97d47be6b59fb7a39ac6160319f3982674ed562143bfa0f93bc8a3e4c8da8bd963

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe

Filesize
468KB

MD5
23e23825b09052caa275f2ea3df9d1f8

SHA1
e17b1b48d2ef243d24370854bf9dc5e6daaa7ea6

SHA256
c47d0e064a8b1d6f7bbdd6f59b70171078b699d6daa2c3aeeafa9c41b9661cf8

SHA512
48deee00c08a673db9a17ba573be7b1e848fc4e63c9624561d2a7d9e5593b8bca39b36f5fd1f3e4d5cde62bedb2b71dec1fc502c4c981f26b47b6d6c22d3abec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe

Filesize
468KB

MD5
3c59f46cc2718e363eb7b0e1b2a7d475

SHA1
0b3bdb759f4f591fc4834b6ad738b4cc2c912c4d

SHA256
64323b228eeb4deee6eecf7518f0aba86bdba0e376f2efdb9da8e0fda151631f

SHA512
cded159454280942ef35f8cc509c68114f8a347bc850ad5ddf6e081f667f22061df9a10135bee43c5586e610798c6fe2b41a652e38938f0ab2bfdeb2a862b589

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe

Filesize
468KB

MD5
41dacf9895710db6f63b672d54e41871

SHA1
95620c3ff1d9c1eb13e50b9a39cd7fecca2f69e4

SHA256
91a86cd4e464d395469492f299cd63f07f634337866f3bb3122c32f0b1947c39

SHA512
cb9b1239d605ed3b7a1d26f08c0eabcfb2019f1a50efd7dc9857dcee06d7fde96316ee655b00d5d429d69265138f66bcb7db035dbc94370498647324da6e3c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe

Filesize
468KB

MD5
28e591fe59d2aa46cf48b95f3ccf4308

SHA1
ae0a544d9961aaf7f0dc9b3a3d28154906b9fd2b

SHA256
c9a13c123ee60d4c07627e2bdd6f7f95dbe38e2d7b1e05c798046aef836d1e99

SHA512
1d770e126def4549e4644cabc5018cae3fbd0c004496dc5890d412489f56426e9d1a216ea8fb478e241896c256222d4a5f4fa74ecd4a4a64764880ccb05f7018

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe

Filesize
468KB

MD5
35680f3b331cc99ba2ea5518e5434261

SHA1
59a75b04e5d3ec8e3293bcb7646ad704e7d8cb6a

SHA256
d3adbdef40836de9fe80358e56e579d26fd48faeb3c482b0de1b1f5e9b309d4d

SHA512
fb8c40f9171a390705666288e3913f6e85060cd7619f5fee21e6f1c580d16ab352520c1d7f38dadeaabbb6f76864cf019b45a65aa5d048ac6c7885334034e2c3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe

Filesize
468KB

MD5
b353d35ed53247aae50c0a3955ce0161

SHA1
7f02fd155586f89c2b9fab597e15ba6de356b602

SHA256
c6fa14fd814812bc36ed5242c660afd5a6627a333dbffd09ecf99e5b6b4c5b04

SHA512
4c9fa216d9136f77522a6c4f20801073f486d8414bcf2e03a7721a9201dfc5134ead0399bed0cc86a7c460d83619978723db2d93bbcd0a73515ca70e7407bd60

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25600.exe

Filesize
468KB

MD5
10039934f07d81730b0fbb557c8238f7

SHA1
4362bb0e162ea776d906219c18a7c647117f087f

SHA256
9775fbf8c9eaf9a2530e8203e3602c3eff323cf28465bc540835cd1f434e91fb

SHA512
54e0189adca573679deab2ee61de708a90129f864c185c31d2aed14fa9f20fc8b7754b3741bd6a6094e791cd7b395440d19eb3da91c751fbb34cc705e8f6c0cf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe

Filesize
468KB

MD5
20d234f2964d5394c26198acb79bbddb

SHA1
6ef61a676c36b42b4cba7c1f3846a0455e6a6a90

SHA256
d9f0ab1dce983d9f0f6e419c4ffda57addbeeb5a010eafdab8273f6efe0f4305

SHA512
fa515ed73dcccc768779f996701bc3e96c0aa10868774b94f4e5c075a30c7f31cb8b8708927f5e649f9c2dd2c4282d76063fa488f61555d71a32710180e9395c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe

Filesize
468KB

MD5
0c9b94009de13bdb2f903a780eb63a8d

SHA1
9d09cc4265d4fbde13cd312026dc1566cf4ac6c8

SHA256
a6df72c8a5a3bf229e1aeff6cc39a8498690f226eb75e88bc6d2001c86266a3b

SHA512
938310ad44cfd5e8a5ff38503de53bff30079b37f32c689af8c162994d44169855e4eda684f8116946506ef60d377e11fb3a69c736a252a2c038eb4cb5fbd153

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27683.exe

Filesize
468KB

MD5
2e94c6825e8d3bbccd6f0612fbdb9d4f

SHA1
6507b992439b2d8f68c73c1de0a1e4f4c39107f5

SHA256
644ff5334e468003d19c5d3ccbf73e48c47e4066e679d48bba92a15930868f00

SHA512
42fd19421058072dfb9d5ad40a865af65eaecec80882b63cab8eaa234223a58f60c8e7c1169dc53b3c8236cc1f0cdc9a99130ecb4a0f3971f9062c1ccc497b6a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28173.exe

Filesize
468KB

MD5
7579827119856927a852a892c08ecbb9

SHA1
50757ba76c116785121a2559ba6835b9088c5636

SHA256
81d185d383c2159eb6f36686adddfd6c0508844c611f22931620e1ede44c9f27

SHA512
d59bf0f4c97afff0ad535968481365e1cd0455ba00275ba445b34e9f331496bdc4a71a6c959dbb0baad23716e145eb614db0da3c332afe16f96f2f4e0a6d9872

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28365.exe

Filesize
468KB

MD5
300eace838613cec81f45149eaed443e

SHA1
7be0c7541c3c012cb36456c0e9e82701572ea474

SHA256
c8c4ea7ae6ff553de85bee66061f0d9b5b18704e62ceb67eac021acbd8752f9e

SHA512
aabff49547139c10c67a195725dde089634daf7f5a0cf0a203c93a955c8cf2cbdd17b32b59959de1356a35606fec111cc6f76da950953ade42ac18f8a8f33682

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe

Filesize
468KB

MD5
e3e47628a6682666129d55a8e7b6ca13

SHA1
4dc5cc6844a86a0e84bb016c649ae4dec541c9c9

SHA256
81a86ecc0477f45705efec4b0199bb65835b05258d3137bf608264f620c08a80

SHA512
ab5e9101b4c878304b746d896aab5b0381047957b91529a2db5dbb1b8763d0c47cb3324ceae51a1ff2e4fa064a85c359ee91fc922fd57752d89e870e40d250b0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe

Filesize
468KB

MD5
b3085db73ca0080ac0bf3b661b498869

SHA1
bac8417442e3d3b855a2d3ac28a3a54ef2ba725e

SHA256
f7d4c3522756857cf2c92a820d10f174f8f0ddd8948116caf1fd37ca6c89290b

SHA512
378f07d341945ffb8e3f3fa353d94d29ddd6e8ffdae5a39bf5db6bfd71738d2dd8f2f5c49627563bc52196c2588c9c1a1b653666a8e86227230207a530054536

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe

Filesize
468KB

MD5
eac1857a009752efec5521008ce4a1e3

SHA1
de9ede022a4d8dffb7049ee6a6254c021ae83687

SHA256
32269e8c467a15f838a6fe9593315a983e88fcf7ed0d2a0fb952c0458a89033c

SHA512
13fa977066f6311528c4dec88c1ac3559a4a2e06194339c784b1a02c415df96a58ab4fdf207d781be7530074745104716ad6be99b7a9baf02379a57b5a99a142

Download Submit