57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feeb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
Size

468KB
MD5

49ea88fc360e7047852f5ae650a3c3e0
SHA1

1d7b51828998ec6fa7b210a7a465e3260123200a
SHA256

57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feeb
SHA512

2954a55cefbfb6c6bf0b492f729150bc0471d93e11c7a6288db46697f41a510261d1f973f0fa6717a1763155d5b391e633937a2aa956f1485e5fcd7112f43459
SSDEEP

3072:d3KCogExjm8UFbYpPz3yqf8/EphjyVplPmHxNlvl4JL+o0fNLQl/:d33oznUFyPDyqfizc94JKpfNL

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2376	Unicorn-22937.exe
2348	Unicorn-4794.exe
2564	Unicorn-59703.exe
2848	Unicorn-57498.exe
2840	Unicorn-44841.exe
2640	Unicorn-15313.exe
2904	Unicorn-9183.exe
1732	Unicorn-59164.exe
592	Unicorn-63803.exe
1460	Unicorn-27177.exe
852	Unicorn-7887.exe
1736	Unicorn-5094.exe
1364	Unicorn-10959.exe
2912	Unicorn-11224.exe
2200	Unicorn-13274.exe
1836	Unicorn-43185.exe
816	Unicorn-13658.exe
2308	Unicorn-28769.exe
1308	Unicorn-48635.exe
2016	Unicorn-45106.exe
748	Unicorn-60294.exe
2328	Unicorn-59225.exe
3028	Unicorn-15963.exe
604	Unicorn-60674.exe
2332	Unicorn-6072.exe
1712	Unicorn-15002.exe
2236	Unicorn-15002.exe
3012	Unicorn-48479.exe
2688	Unicorn-45594.exe
2340	Unicorn-41571.exe
2964	Unicorn-573.exe
2880	Unicorn-52919.exe
2008	Unicorn-47173.exe
2652	Unicorn-53303.exe
2648	Unicorn-22092.exe
1208	Unicorn-60895.exe
532	Unicorn-54647.exe
1464	Unicorn-9208.exe
2448	Unicorn-38311.exe
1908	Unicorn-29074.exe
1664	Unicorn-20527.exe
2788	Unicorn-29458.exe
308	Unicorn-9592.exe
2024	Unicorn-29458.exe
2864	Unicorn-3992.exe
2088	Unicorn-17568.exe
824	Unicorn-45602.exe
632	Unicorn-31303.exe
1440	Unicorn-36474.exe
1952	Unicorn-16608.exe
1708	Unicorn-11704.exe
1048	Unicorn-53002.exe
1580	Unicorn-44450.exe
2136	Unicorn-3344.exe
2408	Unicorn-20522.exe
1552	Unicorn-14391.exe
2752	Unicorn-16800.exe
2872	Unicorn-62021.exe
2724	Unicorn-3043.exe
2600	Unicorn-22909.exe
756	Unicorn-49643.exe
1676	Unicorn-55581.exe
1584	Unicorn-58195.exe
1228	Unicorn-13863.exe

Loads dropped DLL 64 IoCs

pid	Process
2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
2376	Unicorn-22937.exe
2376	Unicorn-22937.exe
2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
2348	Unicorn-4794.exe
2348	Unicorn-4794.exe
2376	Unicorn-22937.exe
2376	Unicorn-22937.exe
2564	Unicorn-59703.exe
2564	Unicorn-59703.exe
2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
2848	Unicorn-57498.exe
2848	Unicorn-57498.exe
2348	Unicorn-4794.exe
2348	Unicorn-4794.exe
2640	Unicorn-15313.exe
2640	Unicorn-15313.exe
2564	Unicorn-59703.exe
2564	Unicorn-59703.exe
2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
2376	Unicorn-22937.exe
2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
2376	Unicorn-22937.exe
2840	Unicorn-44841.exe
2840	Unicorn-44841.exe
1732	Unicorn-59164.exe
1732	Unicorn-59164.exe
2848	Unicorn-57498.exe
2848	Unicorn-57498.exe
1460	Unicorn-27177.exe
1460	Unicorn-27177.exe
852	Unicorn-7887.exe
2904	Unicorn-9183.exe
852	Unicorn-7887.exe
2904	Unicorn-9183.exe
2640	Unicorn-15313.exe
2640	Unicorn-15313.exe
2348	Unicorn-4794.exe
2348	Unicorn-4794.exe
2564	Unicorn-59703.exe
2564	Unicorn-59703.exe
2912	Unicorn-11224.exe
2912	Unicorn-11224.exe
2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
2840	Unicorn-44841.exe
1736	Unicorn-5094.exe
1364	Unicorn-10959.exe
2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
2840	Unicorn-44841.exe
1364	Unicorn-10959.exe
1736	Unicorn-5094.exe
2376	Unicorn-22937.exe
2376	Unicorn-22937.exe
2200	Unicorn-13274.exe
2200	Unicorn-13274.exe
1732	Unicorn-59164.exe
1732	Unicorn-59164.exe
592	Unicorn-63803.exe
592	Unicorn-63803.exe
1836	Unicorn-43185.exe
1836	Unicorn-43185.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2612	1908	WerFault.exe	69
5904	2256	WerFault.exe	138

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34346.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
2376	Unicorn-22937.exe
2348	Unicorn-4794.exe
2564	Unicorn-59703.exe
2848	Unicorn-57498.exe
2640	Unicorn-15313.exe
2840	Unicorn-44841.exe
2904	Unicorn-9183.exe
1732	Unicorn-59164.exe
592	Unicorn-63803.exe
1460	Unicorn-27177.exe
852	Unicorn-7887.exe
2912	Unicorn-11224.exe
1364	Unicorn-10959.exe
1736	Unicorn-5094.exe
2200	Unicorn-13274.exe
1836	Unicorn-43185.exe
816	Unicorn-13658.exe
2308	Unicorn-28769.exe
1308	Unicorn-48635.exe
2016	Unicorn-45106.exe
604	Unicorn-60674.exe
3028	Unicorn-15963.exe
1712	Unicorn-15002.exe
2332	Unicorn-6072.exe
3012	Unicorn-48479.exe
2236	Unicorn-15002.exe
748	Unicorn-60294.exe
2328	Unicorn-59225.exe
2688	Unicorn-45594.exe
2340	Unicorn-41571.exe
2964	Unicorn-573.exe
2880	Unicorn-52919.exe
2008	Unicorn-47173.exe
2652	Unicorn-53303.exe
2648	Unicorn-22092.exe
1208	Unicorn-60895.exe
1464	Unicorn-9208.exe
1908	Unicorn-29074.exe
308	Unicorn-9592.exe
2788	Unicorn-29458.exe
1664	Unicorn-20527.exe
2088	Unicorn-17568.exe
2448	Unicorn-38311.exe
1440	Unicorn-36474.exe
632	Unicorn-31303.exe
1708	Unicorn-11704.exe
1952	Unicorn-16608.exe
2864	Unicorn-3992.exe
824	Unicorn-45602.exe
2024	Unicorn-29458.exe
1580	Unicorn-44450.exe
1048	Unicorn-53002.exe
532	Unicorn-54647.exe
2136	Unicorn-3344.exe
2408	Unicorn-20522.exe
1552	Unicorn-14391.exe
2752	Unicorn-16800.exe
2724	Unicorn-3043.exe
2872	Unicorn-62021.exe
2600	Unicorn-22909.exe
756	Unicorn-49643.exe
1676	Unicorn-55581.exe
1584	Unicorn-58195.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2376	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	30
PID 2096 wrote to memory of 2376	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	30
PID 2096 wrote to memory of 2376	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	30
PID 2096 wrote to memory of 2376	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	30
PID 2376 wrote to memory of 2348	2376	Unicorn-22937.exe	31
PID 2376 wrote to memory of 2348	2376	Unicorn-22937.exe	31
PID 2376 wrote to memory of 2348	2376	Unicorn-22937.exe	31
PID 2376 wrote to memory of 2348	2376	Unicorn-22937.exe	31
PID 2096 wrote to memory of 2564	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	32
PID 2096 wrote to memory of 2564	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	32
PID 2096 wrote to memory of 2564	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	32
PID 2096 wrote to memory of 2564	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	32
PID 2348 wrote to memory of 2848	2348	Unicorn-4794.exe	33
PID 2348 wrote to memory of 2848	2348	Unicorn-4794.exe	33
PID 2348 wrote to memory of 2848	2348	Unicorn-4794.exe	33
PID 2348 wrote to memory of 2848	2348	Unicorn-4794.exe	33
PID 2376 wrote to memory of 2840	2376	Unicorn-22937.exe	34
PID 2376 wrote to memory of 2840	2376	Unicorn-22937.exe	34
PID 2376 wrote to memory of 2840	2376	Unicorn-22937.exe	34
PID 2376 wrote to memory of 2840	2376	Unicorn-22937.exe	34
PID 2564 wrote to memory of 2640	2564	Unicorn-59703.exe	35
PID 2564 wrote to memory of 2640	2564	Unicorn-59703.exe	35
PID 2564 wrote to memory of 2640	2564	Unicorn-59703.exe	35
PID 2564 wrote to memory of 2640	2564	Unicorn-59703.exe	35
PID 2096 wrote to memory of 2904	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	36
PID 2096 wrote to memory of 2904	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	36
PID 2096 wrote to memory of 2904	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	36
PID 2096 wrote to memory of 2904	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	36
PID 2848 wrote to memory of 1732	2848	Unicorn-57498.exe	38
PID 2848 wrote to memory of 1732	2848	Unicorn-57498.exe	38
PID 2848 wrote to memory of 1732	2848	Unicorn-57498.exe	38
PID 2848 wrote to memory of 1732	2848	Unicorn-57498.exe	38
PID 2348 wrote to memory of 592	2348	Unicorn-4794.exe	39
PID 2348 wrote to memory of 592	2348	Unicorn-4794.exe	39
PID 2348 wrote to memory of 592	2348	Unicorn-4794.exe	39
PID 2348 wrote to memory of 592	2348	Unicorn-4794.exe	39
PID 2640 wrote to memory of 1460	2640	Unicorn-15313.exe	40
PID 2640 wrote to memory of 1460	2640	Unicorn-15313.exe	40
PID 2640 wrote to memory of 1460	2640	Unicorn-15313.exe	40
PID 2640 wrote to memory of 1460	2640	Unicorn-15313.exe	40
PID 2564 wrote to memory of 852	2564	Unicorn-59703.exe	41
PID 2564 wrote to memory of 852	2564	Unicorn-59703.exe	41
PID 2564 wrote to memory of 852	2564	Unicorn-59703.exe	41
PID 2564 wrote to memory of 852	2564	Unicorn-59703.exe	41
PID 2096 wrote to memory of 1364	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	42
PID 2096 wrote to memory of 1364	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	42
PID 2096 wrote to memory of 1364	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	42
PID 2096 wrote to memory of 1364	2096	57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe	42
PID 2376 wrote to memory of 1736	2376	Unicorn-22937.exe	43
PID 2376 wrote to memory of 1736	2376	Unicorn-22937.exe	43
PID 2376 wrote to memory of 1736	2376	Unicorn-22937.exe	43
PID 2376 wrote to memory of 1736	2376	Unicorn-22937.exe	43
PID 2840 wrote to memory of 2912	2840	Unicorn-44841.exe	44
PID 2840 wrote to memory of 2912	2840	Unicorn-44841.exe	44
PID 2840 wrote to memory of 2912	2840	Unicorn-44841.exe	44
PID 2840 wrote to memory of 2912	2840	Unicorn-44841.exe	44
PID 1732 wrote to memory of 2200	1732	Unicorn-59164.exe	45
PID 1732 wrote to memory of 2200	1732	Unicorn-59164.exe	45
PID 1732 wrote to memory of 2200	1732	Unicorn-59164.exe	45
PID 1732 wrote to memory of 2200	1732	Unicorn-59164.exe	45
PID 2848 wrote to memory of 1836	2848	Unicorn-57498.exe	46
PID 2848 wrote to memory of 1836	2848	Unicorn-57498.exe	46
PID 2848 wrote to memory of 1836	2848	Unicorn-57498.exe	46
PID 2848 wrote to memory of 1836	2848	Unicorn-57498.exe	46

C:\Users\Admin\AppData\Local\Temp\57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe
"C:\Users\Admin\AppData\Local\Temp\57104b95a3cef53387d7414dec287cd47a4a0b291c052b4c6b1d4df97647feebN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22937.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22937.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59164.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13274.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45594.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62021.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        9⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        9⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        9⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        9⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        8⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        8⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        9⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        8⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        8⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6467.exe
        7⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        8⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        8⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        7⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        8⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        9⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        9⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        9⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        8⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
        7⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exe
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
        7⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        7⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        7⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2182.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45282.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48525.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
        6⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43185.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        7⤵
        Executes dropped EXE
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        8⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        9⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        9⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        9⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        8⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        9⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        9⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exe
        8⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        8⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        8⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62653.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        7⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10526.exe
        6⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        7⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        8⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        8⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        7⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        7⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        7⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8600.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47173.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21264.exe
        6⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        7⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        5⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56312.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
        5⤵
        
        PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-585.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
        5⤵
        
        PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51832.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49561.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        7⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        6⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        6⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
        6⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        7⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        6⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        7⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        7⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29392.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
        6⤵
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53832.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        6⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59494.exe
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        7⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        7⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        7⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe
        6⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        6⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42742.exe
        6⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16852.exe
        5⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exe
        5⤵
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50475.exe
        5⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        6⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10069.exe
        5⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35868.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36695.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36571.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62846.exe
      4⤵
      PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20471.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7698.exe
      4⤵
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44841.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54647.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        8⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        8⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5889.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        7⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
        6⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        8⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63815.exe
        7⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        7⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
        6⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12130.exe
        6⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        7⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        6⤵
        
        PID:856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50137.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24407.exe
        6⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
        5⤵
        
        PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        7⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24751.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
        5⤵
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        5⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        5⤵
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11938.exe
        5⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        6⤵
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        5⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47631.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33571.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
      4⤵
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
      4⤵
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23828.exe
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
      4⤵
      PID:6424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe
        6⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        7⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        7⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        7⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38528.exe
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11912.exe
        5⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42867.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        5⤵
        
        PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
      4⤵
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
        5⤵
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
      4⤵
      PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48479.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1908
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 240
        5⤵
        Program crash
        
        PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
      4⤵
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
      4⤵
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8600.exe
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
      4⤵
      PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36635.exe
      4⤵
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
      4⤵
      PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
      4⤵
      PID:5588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
      4⤵
      PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
      4⤵
      PID:6956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14182.exe
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
    3⤵
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14560.exe
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11898.exe
    3⤵
    PID:6224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15313.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27177.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13658.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45602.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        8⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        8⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        8⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        7⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        6⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11485.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34301.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16608.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60755.exe
        6⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47646.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        7⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
        6⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24263.exe
        6⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19850.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63542.exe
        5⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48985.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42045.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
        6⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57183.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27465.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        6⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exe
        5⤵
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        5⤵
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1709.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35991.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31650.exe
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41663.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7887.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11912.exe
        6⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        7⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
        6⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
        5⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39474.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7698.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56842.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27017.exe
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 200
        5⤵
        Program crash
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32496.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17931.exe
      4⤵
      PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22109.exe
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59225.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        5⤵
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        6⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47631.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
      4⤵
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
      4⤵
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64217.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11599.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43768.exe
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63531.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57033.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
      4⤵
      PID:6268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3344.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
      4⤵
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64656.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50107.exe
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
      4⤵
      PID:6176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe
    3⤵
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9919.exe
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
      4⤵
      PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
    3⤵
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63869.exe
    3⤵
    PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36615.exe
    3⤵
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
    3⤵
    PID:5548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5119.exe
        5⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        6⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        6⤵
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
        5⤵
        
        PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        5⤵
        
        PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58767.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47597.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41922.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50328.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
      4⤵
      PID:1804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
      4⤵
      PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38096.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27935.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28186.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
      4⤵
      PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
      4⤵
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
      4⤵
      PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
    3⤵
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36877.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe
      4⤵
      PID:6496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
    3⤵
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exe
        5⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        6⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1709.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        6⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        5⤵
        
        PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48082.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6467.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40896.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32446.exe
      4⤵
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38096.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        5⤵
        
        PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16644.exe
      4⤵
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9191.exe
        5⤵
        
        PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
      4⤵
      PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9208.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61854.exe
      4⤵
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        5⤵
        
        PID:352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63339.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27465.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
    3⤵
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47597.exe
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
      4⤵
      PID:7108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32496.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
    3⤵
    PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38311.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
      4⤵
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42673.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
      4⤵
      PID:7016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
    3⤵
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45386.exe
      4⤵
      PID:6440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
    3⤵
    PID:3152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
    3⤵
    PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27444.exe
    3⤵
    PID:7088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3992.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
    3⤵
    PID:3556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
    3⤵
    PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
    3⤵
    PID:7040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59584.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59584.exe
  2⤵
  PID:664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
  2⤵
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exe
  2⤵
  PID:5300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe

Filesize
468KB

MD5
d3da40b6f254d46f6fc154f358d3ef4f

SHA1
828728630ccea998c088606e3e4c3922dc9a9edd

SHA256
590458ddbcc5a6918e2a02d73b28bfc34d652600d5dc1c6ea5aeacc0461d3582

SHA512
d0bb8c2ec9ef40525d23e0136f4696d6b118ba376149051101eed257885696179ca5cce4b199f6878b5e3090331b37acc37c22d72d029a9280907e6d4a62bdf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13658.exe

Filesize
468KB

MD5
7bc1a3e8971d9b3e32078c7fdf6c5eee

SHA1
02970527c220f36e6f535ffd1dfe17988b97b665

SHA256
741215f88f1a607945f7a017a78a26413c38d644c3438a809a454480edaf680f

SHA512
25077364025a7ed6c4130e134f25b2a5547be70099d0368169b16a197e16ef9d16fa23875985b6845bea15d94766d3cebb252c56bba5a7039f733eef1f5e7c4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15313.exe

Filesize
468KB

MD5
eb95dd6c00e42fba81f69aac1208e5a9

SHA1
099613be07bae5f40b851a1faf3b85206d6dab17

SHA256
3048691fd591d837d3ae78816133d00e03214c1b95c280ebe9c8e015801a12b6

SHA512
4fd5e4cd8bcfb172a7cef3bf15f73976eb2377e2f43a641d5d588c354cca366c36b74f3da2c9de076db84ed4791f4366443c21e33ea1e635eeca4c123981b74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27177.exe

Filesize
468KB

MD5
70314fca9d0633ef0d39a95fd1c691bd

SHA1
aba28189f9c9885f3cee75472b78d46bedfd1919

SHA256
554cec3415404074a24a008db5d2fce465b8949e21102dd6240f304000c3d9a3

SHA512
85bebfbb1f011b11c06ee526699ae5c3199fc03af5d7234ef9ad81989cd58a3a3cae624d0f7f299341faa70fd655e1e0412a204533bafd14ded6a4efb1aa1fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe

Filesize
468KB

MD5
da0a4d58205b98e1345775462e58d835

SHA1
7e0aacedb91a4dd10b2e15c2b297c55b613e0abc

SHA256
8f336d9d557a437c4c3bab6dea5b44dfe1c09f9404ec87c0f3df0c4897a63044

SHA512
46e081d727e807cec8c835d86b5fa630de69b17c367dbd551d899ffdb9324b57b4ee86c1234878b03e30e4ed1cd30bc5b38da736d4976a275a7af85aeb0872ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe

Filesize
468KB

MD5
306b571e808fd22db5a4d2bed7f9dd79

SHA1
105e0cc38a4c93395d18d67c9071711b93e88d78

SHA256
d81ea101b5018441120e0c1f983530e26ed142b7d29d86bab8fe513aa0bddcb9

SHA512
a919229e4e0f7fd5ec3a0bb7e5d5237531facb6b36a9be838bbb68d0afee3d7ed1327e22da58c61a71554dee72d7d93b0ec9c3d92ec87fa7cb3c9d7907129b02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe

Filesize
468KB

MD5
084331e74396b833d4717148304324a0

SHA1
945c3caec7818d69a7198e6183116801150400f1

SHA256
632a132d211fbefc4eb7863a8cec03b15773cac8c0ce2854b184b20ff3d42182

SHA512
c01658dc04a31211eb47130fee0bc8729da90af7e18542f57416c0b3b32e48e4d206510ce3f9b687810d3a96fc7b0253139def55dca0f6ea7770d9b88c1d56b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59164.exe

Filesize
468KB

MD5
54044e25849002082af376caf5e66f33

SHA1
9a0aa664c83222aa674c305c112c5dd721fd39fc

SHA256
4784953864a96c0c59f698a967623dd88b2c686cedfc3679d124ffcc02e78fe3

SHA512
ca2428b92d817f341c1b2242ae502224dfa0dfefa1a31d0e1bd6bb7187bf08c4bae70864f87d1e83705d21a4450be536c19c54dc19f9177a91efeb7d2edde932

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe

Filesize
468KB

MD5
487e4a5192f4535c0ce19552aa279ba1

SHA1
8e6acb9b1fb35851893ace4dc8700bcda61055cb

SHA256
f201c35228d64c27b4e2b013c4a9009be365cbf4311beaa843c0a2b6abaf9cf8

SHA512
5e3fe75e94c15765e91161cecce8203af1a7a1e9906c36df7c4b960852aa96736420cda3c01252101ddaad6bdf0d4f1fdc5591a24b2af9c8b838f7697ee3e86d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7887.exe

Filesize
468KB

MD5
7da74b3619ff358e219a680cc41ef197

SHA1
51515a25c19cd4d0405708ea1583d8e5d63fbff3

SHA256
a4e93b93b5014edb05d4dc0aa0443570e38a174f92dc9ae04a1f50b192b2c37d

SHA512
c7f42514291eccdaa80372931aad381d719b0ad5d84ff2ddcd07deecc5d273b8252b4beec59edb8c868f5b1c19c8770f6825c7c06caf448d3a827b798f4fcafe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe

Filesize
468KB

MD5
b706a3d14ae4d4184b2ffbe7bd11f768

SHA1
8ba6c1d14a59c34907771ea19a236778c1f57644

SHA256
9d3ba69f8b6d2a94237ea90028fc219410a6bd31d324b978b4ae8d8e2e0d505e

SHA512
471635ca8ea645a4d3988d1958393c0dddd7f7ff5ff37c2e4473ef23b81c30553c7a86a303e6a4637620f9c4baa5a1142b82894cd705709e423041e208d36fc1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe

Filesize
468KB

MD5
f6e62853aa71d0245354a91534451acf

SHA1
f285649c57b663d5037506535316e86fbf6782ec

SHA256
8c794f013b8bb0619a727b177379d6932f50d07d5598f3f601a239229e75d5d7

SHA512
89aeefc2fd92c28461bf826b3d0a094287d19e1e1e0853fb6e104f83d7ea4736e6cfc76b819dd9afddf82aabd518f911418b3af63f4bca2327bbdd57c65056aa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13274.exe

Filesize
468KB

MD5
aa081dc056c8f015542e5738819507fe

SHA1
95d1f7cac569f1c4c0eb628501dcf962716a3272

SHA256
0b864cf56bd497cdba393fb75874c4cdb5aecedafff632a5d8a65a4e38df2b5d

SHA512
9e53a32efdafe10e3dda30a611b59f4f34a9b90397e57eb83c92ad568686fdabf777975591f7aaa9febb06bc8a9d3a0badb8eaebecf0e41f169818366593c959

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22937.exe

Filesize
468KB

MD5
61a3cf7a10248edd5664a7553b2e08be

SHA1
a98ef56513306cf63054190f83e66102a8c3331f

SHA256
85d4f6eec7353f2cf4f1f81dbfa68be6c426aa952e66dd3402234338d788b6cb

SHA512
ed2f8f5ca1dfbbe33fce16eb2c3dcf51760babeabaa01a48ea4766dba80bb0f91596fc087678dc1ed5e71496f77c87939aed55658b5ea91513a82a00cca0bf0e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43185.exe

Filesize
468KB

MD5
e436ac0651ebffa9baba2953ca2330c8

SHA1
7689a050fcf6e0264599b5c4fd7862d9a3b625e7

SHA256
18b15b91ec79f984f611e3cce69d812578ba5f163d0c78a946e5d095183699bd

SHA512
5ba9fb2d64b783092ad9e907a790b4803e038ff07b0bb297f77633a97a58f4a3a6883a2f3c5d41535e03914219745a0b67a1204b80e7c7a43e152e676eb7ec0e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44841.exe

Filesize
468KB

MD5
63b441e4d41f369049ca04eeadcb95b4

SHA1
e9ba0a996bb3e48cd60f3672efcf86bcac7389f7

SHA256
38eeac780386d126f83235833197a24d59a9c36d8cc6d8fac4d97e102da55620

SHA512
d3e7785b72c05cf88b0f24e5bc79095fcd21c5ad7079d144ab238b5ca1aa1aa8a7d9535d21239657427c441c5d0691c2c0d232f3412cbc8e2c3fcdfb963f1eaa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe

Filesize
468KB

MD5
17fa311057ca12daa13416505f737732

SHA1
78f545cb3daf0c030c11e256aa12bfabea90cf33

SHA256
e3f1657552842f6a75f5fb64792fb69688406472cdff169d5532f0ffbe266176

SHA512
f232cf5d721faad8469a23709c9fcdb65b7374afad5f33094b090a286a23f4acab2fb8de3ad5b59e3cc4d24a414525b11cb9efdcbeeaf88f3c97da5f9c81cc33

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe

Filesize
468KB

MD5
6439f71c4ba32cf19afe7c89c29c6a0e

SHA1
975ba80489d6b10d23c1424bfba4515c0ea5c6f3

SHA256
cc252229f4e05c4b6083afb7d0a6b190684567f9558ed7c3b130095c22f43506

SHA512
6e8fd1be33183a2b839ea91f7f7404e4cb9f065d2ced814fbfd5f29b514e7fc1f20734151e5e5944269a7350a8dd56d6258d0509a019b774c9f988d226155e98

Download Submit
memory/532-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/592-346-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/592-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/592-344-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/604-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/816-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/852-230-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/852-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/852-232-0x00000000007D0000-0x0000000000845000-memory.dmp

Filesize
468KB

Download
memory/1208-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1308-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1364-292-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1364-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1364-286-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1364-418-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1460-209-0x0000000002410000-0x0000000002485000-memory.dmp

Filesize
468KB

Download
memory/1460-208-0x0000000002410000-0x0000000002485000-memory.dmp

Filesize
468KB

Download
memory/1460-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-391-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1712-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-397-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1732-335-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1732-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-179-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1732-184-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1732-331-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1736-285-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/1736-293-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/1736-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-355-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/1836-354-0x00000000033C0000-0x0000000003435000-memory.dmp

Filesize
468KB

Download
memory/2008-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2096-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2096-156-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2096-11-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2096-142-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2096-10-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2096-284-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2096-387-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2096-287-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2096-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2200-326-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2200-324-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2308-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-375-0x0000000000600000-0x0000000000675000-memory.dmp

Filesize
468KB

Download
memory/2328-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-427-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2332-413-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2332-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-47-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2348-255-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2348-248-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2348-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-412-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2376-296-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2376-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-300-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2376-54-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2376-157-0x0000000001C70000-0x0000000001CE5000-memory.dmp

Filesize
468KB

Download
memory/2376-25-0x0000000003340000-0x00000000033B5000-memory.dmp

Filesize
468KB

Download
memory/2564-262-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2564-261-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2564-129-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2564-128-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2564-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-239-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2640-240-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2648-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-289-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2840-159-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2840-167-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2848-196-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2848-372-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2848-362-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2848-195-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/2880-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-384-0x0000000003170000-0x00000000031E5000-memory.dmp

Filesize
468KB

Download
memory/2904-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-231-0x0000000003170000-0x00000000031E5000-memory.dmp

Filesize
468KB

Download
memory/2912-273-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2912-265-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2912-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-415-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/3028-403-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/3028-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download