8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8

Analysis

max time kernel
119s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
Size

468KB
MD5

89419e54691bd2960998543b6fd3b7c0
SHA1

99d4dc4b09692c7efd8955b592b0ae955f82e6fc
SHA256

8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8
SHA512

6548a193e90d83f81690194da2b610aa3aa6865dd9b62aa4171cb4a2c99d41494c5844487941b21bbd4177df15de5d9907df5a83e30371d50b1145a1e9c48502
SSDEEP

3072:yb01ogAEIY5AtbYnzfHTffCL0Zjq+pphJEHCYVm+IxMLFHfsccly:yb+oxYAtgz/TffTfrmIxm5fsc

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2792	Unicorn-24277.exe
2680	Unicorn-20551.exe
2728	Unicorn-14006.exe
1608	Unicorn-38314.exe
1952	Unicorn-63565.exe
2668	Unicorn-17894.exe
1400	Unicorn-7679.exe
2888	Unicorn-39705.exe
2224	Unicorn-61832.exe
1988	Unicorn-61277.exe
772	Unicorn-25790.exe
564	Unicorn-16139.exe
2616	Unicorn-31921.exe
1160	Unicorn-48184.exe
2528	Unicorn-58236.exe
1736	Unicorn-22034.exe
1868	Unicorn-38008.exe
644	Unicorn-54737.exe
448	Unicorn-41001.exe
1316	Unicorn-44723.exe
2172	Unicorn-61806.exe
844	Unicorn-566.exe
2088	Unicorn-45683.exe
1692	Unicorn-45683.exe
876	Unicorn-25817.exe
1884	Unicorn-16829.exe
1464	Unicorn-8926.exe
2388	Unicorn-65533.exe
2320	Unicorn-51997.exe
1432	Unicorn-25886.exe
3060	Unicorn-1381.exe
996	Unicorn-47053.exe
3008	Unicorn-44452.exe
3044	Unicorn-41838.exe
3048	Unicorn-41838.exe
1524	Unicorn-4816.exe
2948	Unicorn-38500.exe
2936	Unicorn-58366.exe
2128	Unicorn-32583.exe
2260	Unicorn-38714.exe
2804	Unicorn-59881.exe
2080	Unicorn-30738.exe
1668	Unicorn-39652.exe
1392	Unicorn-55434.exe
2244	Unicorn-13560.exe
2844	Unicorn-13825.exe
1156	Unicorn-54858.exe
264	Unicorn-50012.exe
1648	Unicorn-54858.exe
1976	Unicorn-43352.exe
332	Unicorn-41520.exe
1180	Unicorn-47650.exe
2756	Unicorn-55049.exe
1196	Unicorn-64178.exe
2956	Unicorn-23892.exe
2112	Unicorn-31506.exe
2216	Unicorn-60841.exe
2396	Unicorn-41136.exe
2456	Unicorn-55901.exe
1604	Unicorn-10763.exe
1540	Unicorn-51241.exe
2512	Unicorn-16522.exe
1960	Unicorn-22653.exe
1596	Unicorn-43265.exe

Loads dropped DLL 64 IoCs

pid	Process
2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
2792	Unicorn-24277.exe
2792	Unicorn-24277.exe
2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
2680	Unicorn-20551.exe
2680	Unicorn-20551.exe
2728	Unicorn-14006.exe
2792	Unicorn-24277.exe
2728	Unicorn-14006.exe
2792	Unicorn-24277.exe
2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
1608	Unicorn-38314.exe
1608	Unicorn-38314.exe
2680	Unicorn-20551.exe
2680	Unicorn-20551.exe
1952	Unicorn-63565.exe
1952	Unicorn-63565.exe
2728	Unicorn-14006.exe
2792	Unicorn-24277.exe
2792	Unicorn-24277.exe
2728	Unicorn-14006.exe
1400	Unicorn-7679.exe
1400	Unicorn-7679.exe
2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
2888	Unicorn-39705.exe
2888	Unicorn-39705.exe
1608	Unicorn-38314.exe
1608	Unicorn-38314.exe
2224	Unicorn-61832.exe
2224	Unicorn-61832.exe
2680	Unicorn-20551.exe
2680	Unicorn-20551.exe
2668	Unicorn-17894.exe
2668	Unicorn-17894.exe
1988	Unicorn-61277.exe
1988	Unicorn-61277.exe
1952	Unicorn-63565.exe
1952	Unicorn-63565.exe
2616	Unicorn-31921.exe
2616	Unicorn-31921.exe
1160	Unicorn-48184.exe
772	Unicorn-25790.exe
1400	Unicorn-7679.exe
1160	Unicorn-48184.exe
772	Unicorn-25790.exe
1400	Unicorn-7679.exe
2792	Unicorn-24277.exe
2792	Unicorn-24277.exe
2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
564	Unicorn-16139.exe
564	Unicorn-16139.exe
2728	Unicorn-14006.exe
2728	Unicorn-14006.exe
2528	Unicorn-58236.exe
2528	Unicorn-58236.exe
1736	Unicorn-22034.exe
2888	Unicorn-39705.exe
1736	Unicorn-22034.exe
2888	Unicorn-39705.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
2492	2844	WerFault.exe	74
832	2396	WerFault.exe	87
1500	2124	WerFault.exe	97
2488	2336	WerFault.exe	134
3736	2392	WerFault.exe	111
3764	2592	WerFault.exe	107
6476	1652	WerFault.exe	147
6984	2220	WerFault.exe	141
6992	1580	WerFault.exe	120

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53590.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
2792	Unicorn-24277.exe
2680	Unicorn-20551.exe
2728	Unicorn-14006.exe
1608	Unicorn-38314.exe
2668	Unicorn-17894.exe
1400	Unicorn-7679.exe
1952	Unicorn-63565.exe
2888	Unicorn-39705.exe
2224	Unicorn-61832.exe
1988	Unicorn-61277.exe
772	Unicorn-25790.exe
564	Unicorn-16139.exe
1160	Unicorn-48184.exe
2616	Unicorn-31921.exe
2528	Unicorn-58236.exe
1736	Unicorn-22034.exe
1868	Unicorn-38008.exe
644	Unicorn-54737.exe
448	Unicorn-41001.exe
1316	Unicorn-44723.exe
2172	Unicorn-61806.exe
2088	Unicorn-45683.exe
876	Unicorn-25817.exe
844	Unicorn-566.exe
1692	Unicorn-45683.exe
1884	Unicorn-16829.exe
1464	Unicorn-8926.exe
2388	Unicorn-65533.exe
2320	Unicorn-51997.exe
1432	Unicorn-25886.exe
996	Unicorn-47053.exe
3060	Unicorn-1381.exe
3008	Unicorn-44452.exe
3044	Unicorn-41838.exe
3048	Unicorn-41838.exe
2936	Unicorn-58366.exe
1524	Unicorn-4816.exe
2948	Unicorn-38500.exe
2260	Unicorn-38714.exe
2128	Unicorn-32583.exe
2804	Unicorn-59881.exe
2080	Unicorn-30738.exe
1668	Unicorn-39652.exe
1392	Unicorn-55434.exe
2844	Unicorn-13825.exe
2244	Unicorn-13560.exe
1156	Unicorn-54858.exe
264	Unicorn-50012.exe
1648	Unicorn-54858.exe
1976	Unicorn-43352.exe
1180	Unicorn-47650.exe
332	Unicorn-41520.exe
1196	Unicorn-64178.exe
2756	Unicorn-55049.exe
2956	Unicorn-23892.exe
2112	Unicorn-31506.exe
2216	Unicorn-60841.exe
2396	Unicorn-41136.exe
1604	Unicorn-10763.exe
2456	Unicorn-55901.exe
1540	Unicorn-51241.exe
1596	Unicorn-43265.exe
1960	Unicorn-22653.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2792	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	30
PID 2688 wrote to memory of 2792	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	30
PID 2688 wrote to memory of 2792	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	30
PID 2688 wrote to memory of 2792	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	30
PID 2792 wrote to memory of 2680	2792	Unicorn-24277.exe	31
PID 2792 wrote to memory of 2680	2792	Unicorn-24277.exe	31
PID 2792 wrote to memory of 2680	2792	Unicorn-24277.exe	31
PID 2792 wrote to memory of 2680	2792	Unicorn-24277.exe	31
PID 2688 wrote to memory of 2728	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	32
PID 2688 wrote to memory of 2728	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	32
PID 2688 wrote to memory of 2728	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	32
PID 2688 wrote to memory of 2728	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	32
PID 2680 wrote to memory of 1608	2680	Unicorn-20551.exe	33
PID 2680 wrote to memory of 1608	2680	Unicorn-20551.exe	33
PID 2680 wrote to memory of 1608	2680	Unicorn-20551.exe	33
PID 2680 wrote to memory of 1608	2680	Unicorn-20551.exe	33
PID 2728 wrote to memory of 2668	2728	Unicorn-14006.exe	34
PID 2728 wrote to memory of 2668	2728	Unicorn-14006.exe	34
PID 2728 wrote to memory of 2668	2728	Unicorn-14006.exe	34
PID 2728 wrote to memory of 2668	2728	Unicorn-14006.exe	34
PID 2792 wrote to memory of 1952	2792	Unicorn-24277.exe	35
PID 2792 wrote to memory of 1952	2792	Unicorn-24277.exe	35
PID 2792 wrote to memory of 1952	2792	Unicorn-24277.exe	35
PID 2792 wrote to memory of 1952	2792	Unicorn-24277.exe	35
PID 2688 wrote to memory of 1400	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	36
PID 2688 wrote to memory of 1400	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	36
PID 2688 wrote to memory of 1400	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	36
PID 2688 wrote to memory of 1400	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	36
PID 1608 wrote to memory of 2888	1608	Unicorn-38314.exe	37
PID 1608 wrote to memory of 2888	1608	Unicorn-38314.exe	37
PID 1608 wrote to memory of 2888	1608	Unicorn-38314.exe	37
PID 1608 wrote to memory of 2888	1608	Unicorn-38314.exe	37
PID 2680 wrote to memory of 2224	2680	Unicorn-20551.exe	38
PID 2680 wrote to memory of 2224	2680	Unicorn-20551.exe	38
PID 2680 wrote to memory of 2224	2680	Unicorn-20551.exe	38
PID 2680 wrote to memory of 2224	2680	Unicorn-20551.exe	38
PID 1952 wrote to memory of 1988	1952	Unicorn-63565.exe	39
PID 1952 wrote to memory of 1988	1952	Unicorn-63565.exe	39
PID 1952 wrote to memory of 1988	1952	Unicorn-63565.exe	39
PID 1952 wrote to memory of 1988	1952	Unicorn-63565.exe	39
PID 2792 wrote to memory of 772	2792	Unicorn-24277.exe	41
PID 2792 wrote to memory of 772	2792	Unicorn-24277.exe	41
PID 2792 wrote to memory of 772	2792	Unicorn-24277.exe	41
PID 2792 wrote to memory of 772	2792	Unicorn-24277.exe	41
PID 2728 wrote to memory of 564	2728	Unicorn-14006.exe	40
PID 2728 wrote to memory of 564	2728	Unicorn-14006.exe	40
PID 2728 wrote to memory of 564	2728	Unicorn-14006.exe	40
PID 2728 wrote to memory of 564	2728	Unicorn-14006.exe	40
PID 1400 wrote to memory of 2616	1400	Unicorn-7679.exe	42
PID 1400 wrote to memory of 2616	1400	Unicorn-7679.exe	42
PID 1400 wrote to memory of 2616	1400	Unicorn-7679.exe	42
PID 1400 wrote to memory of 2616	1400	Unicorn-7679.exe	42
PID 2688 wrote to memory of 1160	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	43
PID 2688 wrote to memory of 1160	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	43
PID 2688 wrote to memory of 1160	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	43
PID 2688 wrote to memory of 1160	2688	8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe	43
PID 2888 wrote to memory of 2528	2888	Unicorn-39705.exe	44
PID 2888 wrote to memory of 2528	2888	Unicorn-39705.exe	44
PID 2888 wrote to memory of 2528	2888	Unicorn-39705.exe	44
PID 2888 wrote to memory of 2528	2888	Unicorn-39705.exe	44
PID 1608 wrote to memory of 1736	1608	Unicorn-38314.exe	45
PID 1608 wrote to memory of 1736	1608	Unicorn-38314.exe	45
PID 1608 wrote to memory of 1736	1608	Unicorn-38314.exe	45
PID 1608 wrote to memory of 1736	1608	Unicorn-38314.exe	45

C:\Users\Admin\AppData\Local\Temp\8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe
"C:\Users\Admin\AppData\Local\Temp\8b4c4bb8410e31dd88e9085709252cea804ad475fb2016369e3fb3fe5d7e81e8N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39705.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25886.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55901.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
        9⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4363.exe
        10⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        10⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        10⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        9⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        9⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        9⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        9⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        9⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
        8⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27378.exe
        8⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12229.exe
        8⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55125.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10763.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
        8⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44825.exe
        8⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        8⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16116.exe
        8⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
        7⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7424.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61644.exe
        7⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
        8⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 220
        9⤵
        Program crash
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
        8⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        8⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16454.exe
        8⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        7⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49112.exe
        8⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        8⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        7⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe
        7⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16454.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        6⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10730.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        7⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22762.exe
        6⤵
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37946.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
        6⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22034.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30025.exe
        8⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48909.exe
        8⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
        8⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3161.exe
        7⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47600.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48831.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41151.exe
        7⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
        6⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42980.exe
        7⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 240
        8⤵
        Program crash
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        7⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        6⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12229.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3161.exe
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59320.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53680.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        6⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        5⤵
        
        PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11928.exe
        5⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29404.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34308.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61832.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40141.exe
        7⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        8⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        8⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        8⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        7⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        7⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        6⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 240
        7⤵
        Program crash
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        6⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44925.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25307.exe
        6⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
        6⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
        6⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64208.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
        7⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        6⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3979.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57454.exe
        6⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
        5⤵
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        5⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54737.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        6⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26268.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48385.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21290.exe
        7⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53590.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        6⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57800.exe
        5⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        6⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        5⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        5⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26076.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48385.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
        6⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        5⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
      4⤵
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14612.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
      4⤵
      PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56290.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe
      4⤵
      PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59518.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61277.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44723.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38714.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        7⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
        8⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        8⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        8⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        8⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe
        7⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
        7⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49331.exe
        6⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        7⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30015.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59881.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        6⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        7⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2448.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        7⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
        6⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        6⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61722.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43414.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18916.exe
        6⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35271.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        5⤵
        
        PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
        6⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64208.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
        7⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38459.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        6⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13694.exe
        6⤵
        
        PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        5⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52484.exe
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41136.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 240
        5⤵
        Program crash
        
        PID:832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
      4⤵
      PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
      4⤵
      PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
      4⤵
      PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
      4⤵
      PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45683.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
        6⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13247.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48385.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
        7⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exe
        5⤵
        
        PID:2220
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 220
        6⤵
        Program crash
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        5⤵
        
        PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40891.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
        5⤵
        
        PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        5⤵
        
        PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1724.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe
      4⤵
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50487.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        5⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24590.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34119.exe
      4⤵
      PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64545.exe
      4⤵
      PID:7116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13825.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2844
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 240
        5⤵
        Program crash
        
        PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21448.exe
      4⤵
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5181.exe
        5⤵
        
        PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
      4⤵
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
      4⤵
      PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
      4⤵
      PID:7164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe
      4⤵
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
        5⤵
        
        PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37092.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
      4⤵
      PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
      4⤵
      PID:7400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60166.exe
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15574.exe
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42592.exe
    3⤵
    PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31590.exe
    3⤵
    PID:6556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41001.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58366.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        6⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        7⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        6⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41805.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        5⤵
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        6⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
        5⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
        5⤵
        
        PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32583.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27780.exe
        5⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5050.exe
        6⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55220.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24090.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-964.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        6⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64926.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21448.exe
        5⤵
        
        PID:2336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 240
        6⤵
        Program crash
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
        5⤵
        
        PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18152.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        5⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        5⤵
        
        PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64999.exe
      4⤵
      PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43308.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45455.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
      4⤵
      PID:6972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64178.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5050.exe
        6⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25009.exe
        6⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
        5⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3979.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41118.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51114.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22891.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38789.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        5⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27336.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22021.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60051.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        6⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46081.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        5⤵
        
        PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
      4⤵
      PID:328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35271.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
      4⤵
      PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15335.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        5⤵
        
        PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45048.exe
        5⤵
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57836.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
        5⤵
        
        PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6838.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64926.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
      4⤵
      PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
      4⤵
      PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
      4⤵
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27780.exe
      4⤵
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7497.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14612.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
    3⤵
    PID:2592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 240
      4⤵
      Program crash
      PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
    3⤵
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exe
    3⤵
    PID:3080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
    3⤵
    PID:4192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
    3⤵
    PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
    3⤵
    PID:6892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31921.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
        6⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 240
        7⤵
        Program crash
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21862.exe
        6⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16850.exe
        5⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10730.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47124.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        5⤵
        
        PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16454.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        6⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47881.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        5⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61644.exe
        5⤵
        
        PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58598.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37420.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31799.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
      4⤵
      PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65258.exe
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        5⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21923.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exe
      4⤵
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47709.exe
        5⤵
        
        PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
      4⤵
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
      4⤵
      PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35469.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
      4⤵
      PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
      4⤵
      PID:7392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
    3⤵
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
      4⤵
      PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1194.exe
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
      4⤵
      PID:6800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
    3⤵
    PID:3108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20039.exe
    3⤵
    PID:3264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37946.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
    3⤵
    PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45683.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57800.exe
      4⤵
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25639.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40216.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
      4⤵
      PID:300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
      4⤵
      PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
      4⤵
      PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42085.exe
      4⤵
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
      4⤵
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
      4⤵
      PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
    3⤵
    PID:2884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
    3⤵
    PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22891.exe
    3⤵
    PID:5452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
    3⤵
    PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55317.exe
    3⤵
    PID:7080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57183.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34881.exe
        5⤵
        
        PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54268.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61644.exe
      4⤵
      PID:7344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
    3⤵
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe
      4⤵
      PID:7212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
    3⤵
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
    3⤵
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
    3⤵
    PID:4808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
    3⤵
    PID:6564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39153.exe
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
    3⤵
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
    3⤵
    PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17185.exe
    3⤵
    PID:6688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
  2⤵
  PID:1840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
  2⤵
  PID:3948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe
  2⤵
  PID:1552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35700.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35700.exe
  2⤵
  PID:4924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
  2⤵
  PID:5688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13389.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13389.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe

Filesize
468KB

MD5
b5b644d57258147714d21e9c6f7ca762

SHA1
a36fa14a16b9f9f991121078eca3f745b37ecf70

SHA256
45801f62c949b0a4a657338821434d85c823c5d09a2d781c4fc8205477956862

SHA512
1279b9ca0da789663480bbf963123ec5f5cc4c3d1a11b67aaa6a2715198e955963d16f363401214285addff1b4f66a2a7c230ca2c40c4c5c93e6ef1e60dd64df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe

Filesize
468KB

MD5
d44e6aca7533016e9fd98f59a83ccee3

SHA1
3502278dbbb0d10eabaa6836fe8a42b6e17de5bc

SHA256
6d63f0531f66f9c741e5bcfdbe66b4f9e5bb6ee5d6d64f75cb7d2b790e6208d1

SHA512
6cf880f72f12d94c150193b7362a23837ad7527e7ca317609da42727a72af8ad3d19ca83ac577baeea0374cb4a0901f707d9b19fc56b8079b006dde0fea5e12f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe

Filesize
468KB

MD5
3719a8c24e737e56db3051ee30695347

SHA1
44386b2dd98e79ff9ab7b30ad73a0bc6c3dae15f

SHA256
fc0ad5d8e2523beac54957e9e27fbfba330741af312711cd74175e664d6d162b

SHA512
69f90052a9456b25d868770b8d8623df4ed1846d1400c3341174dab63a63af13aec02a7d972b56e6bb048283ad0171d88cb77ef4206f0eb2076e418345b2682a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe

Filesize
468KB

MD5
011f871b0b6fabbcca2ad923fcb68173

SHA1
7a056efeaa5656575deef5dab080a57aa1632621

SHA256
90e476cc2aeff00e84a77d13b22470227f5f8e7bd54bde40d4a3e96fcf5bade3

SHA512
646fe7058334d71b0bf905ed06cbf6748f4388c00d38fdecd7f90831860194845997d78bbc08ca5aa7a636aa1e7656d73c953ab5658863022b9cb8611e107616

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe

Filesize
468KB

MD5
e6f08f9b2028a9c4800dd0709aa5ec1b

SHA1
a27f8c848c39acfa265d250527d5c84ac8b71f3c

SHA256
3c40e1bbcd1cb3d0500ab14da4a9be791c9eecaf3ec64d083442b390c54a38db

SHA512
92a134801d69390fd3f5eeddcdabf1f4e3bffca1eff934ed40701f6d09a2fecdfaaaff4c2f2c2e9f599953beb6fc9436cde1e180d8b15fc6e35ff5b42bf7b45d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54737.exe

Filesize
468KB

MD5
bb1e3f04193c620fad300d0d6c7b6b5f

SHA1
c8450669adce8468b3be099ea4945a163f38d47f

SHA256
7d8b78b3f9dd518a59b1541b84c6ed4661a1c779c32e3e6a7eb13839a5096e4a

SHA512
fffec9c27d6cedeed2b74f7ec3e0df0ba9135c1f2a2d1b34ffd8b1f3c8e6e90bbc8d5ec4b4cc352ff9e35ba16653ec0b572655694b955ad1568ed55ee85c7c6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe

Filesize
468KB

MD5
9b6d0b4bf3e87a1802add9709116364e

SHA1
c8a514ee8d856729cd6b559102966af318b0321a

SHA256
dc9f26f957f6148899cee520476c5f6e32b05bf688282a9dea96cca90612b24e

SHA512
b9c983bf913ed2aa66e66eb283a6d27bb0557cde42bfdc9334e5ee78b6fd33baa8f6cc03cef8a6d6937b871a72fd476c78c469e8300b2490eacf08e91b3870b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61277.exe

Filesize
468KB

MD5
4d82dc9ad01de1e6d4ed860a01788143

SHA1
b35c0b5ef77af54b3d82a362e19abbd4f0961812

SHA256
52f888d4fe5a4b5da85a2ab50cd948fd87182f6e7e63b86d698c1fbd7fb58a93

SHA512
545d562950748784f94f09c5c7fb2f30b5ddc4b5e31edd75a49164eefff9ddbff542c07bf1bf24793c4afbb00a8dba840cccff09a02d91a7697764cdc7b31067

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe

Filesize
468KB

MD5
8c9fda2d3c808d713d97cdf5de2d84b0

SHA1
9b878c2755ee1e192dcb62d6cea011156c2d771d

SHA256
5469796303d2339f118c77055e27f7f10c557e197fdee0ac57f50f3214637e62

SHA512
533743487c3e2b41d239c66a1a38a847028f1ae87abed0dc709447be218e7998223d58454d07688fe2e99ff4c324e4a304c9d285d5c7111d42440f3a25172f6f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe

Filesize
468KB

MD5
8d7df3f7db0c9c88deb68717bb0f9404

SHA1
060210a7db20ded176de6a408b1309862e7ebad3

SHA256
0f9e22798974b7bc15011b0da8161b311ff28ba7a7c48a19f5c0504624d575e4

SHA512
613632b709b8e7ed12bdfc0b7d0b610fb5c3ce1b05f89093d555bcd3a81289f15c59deba32e324070cc01dd0caee519b7e2cc34f9381a73b2496dcdacbd58626

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe

Filesize
468KB

MD5
edbcbded6a27a3c5b5d5168ed13a03a7

SHA1
eec8774b67294ebe5cbeaf484ab4d70e0bde6647

SHA256
ad14b687d240f372b435bd97496776ff4c99d195828dc7c5779a0f1afb84b1ca

SHA512
3ca7577408bfb728088eca04e1f95b7d3d590fc240daea731e71cffa7d8257472fa354c7a1642f64a5a253410cdac33a2284f8406f9e7d690e5e7e79285d60c3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe

Filesize
468KB

MD5
19ee5ee02f244eb26c829ee64714a46a

SHA1
4d34a2b97b657e8aa066a5f8430672fd989f80ec

SHA256
90977bdf6b71e3dcfb8bba28950294ab23ec9d93b5836592d34a5aff9bf027da

SHA512
e298a5d972d502027d2dbe1acde641f3e9d14105f90c8d193008576b018f50811803602daa51ea6993921019007f70d433f2bd0dbc96876ab289177255ecf587

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22034.exe

Filesize
468KB

MD5
9389c69b19df30d0ef43bbb319d41a74

SHA1
5e5d916ba7c7c4cf5750f729d6410c7dfa8b63a0

SHA256
8d407c4cb55f6cad7de1a8ec13640eca9e73a3d16bc8edd85576fbd35253e71e

SHA512
bf34419463f9f015a3140d917b2b79d1dd9834fcb8f59611444f4731a18b36acdcbb09f565e3138e8e0970ca7d5018e92890fb143731db3e6fb87cf2b946b95f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe

Filesize
468KB

MD5
7b25533ec83b5f5583adff939e1db5af

SHA1
c44a804455b486cd5984040aa104e8acb1f58b59

SHA256
f7c46a523c8863cd27882eecda2facf8c861b958203f2861fc2e95cae5951e2c

SHA512
567ce2c0a904dd6dfb062e91eb5343c409ce5fa065c76a6b7e248468f7c2ecd46b6ed9045d590cfd9335b4a37db9e9e9ac8295d49a4a50899968dfde9e21a2dd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe

Filesize
468KB

MD5
4a215f908f5b143eb1c845e3bba66631

SHA1
928a97f46befc05eb0225b484ee493d3e7a9b8ce

SHA256
6ee7cdc4fb1e9a6e6e65274c14d8ce6c0b7e89450458f279934e4a8a13d5d521

SHA512
658fafb4119663fcfca2060ff011dd759719a91224fe8afb86267de97ce28824b8842a1f793c42b976c7960c85d028b4670debac1efe73089e742f16e7c9d8e4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31921.exe

Filesize
468KB

MD5
e9e8441dbc6479c2b56a1df72ec8dbb0

SHA1
d1f0c8a944447e85a1777a078005450fbf8cf0a2

SHA256
0ec985e2edddc47df249db014699e989a5960e10bfa4619029c410fd4696a937

SHA512
a193e25c7b788cb6e8448e39e18129b373c8400dc232292b5fef2c78b8b58afa3ba9e7400f3c7ab93530235f3ac1d5b3649f4bf4a3be4ca679eb269011cb693d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe

Filesize
468KB

MD5
5107b19c199f4e8bea6e27f44feb8d99

SHA1
e54742ed31b524585fce0791b5fbf3af6312263d

SHA256
f50cd73c44506ece589deac014bd42eee0102a65e0e1566796f1d7a83f189c2a

SHA512
754ffb0c46941b458273253199d2f712c65368e99a05b014cfc4de3f706987aca8862f40fabfc6377de2072ccf2994e24729dba453df34382b4b577a00ab5e4b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39705.exe

Filesize
468KB

MD5
20abefb6cfb8722e643cfc5c2fab5b0e

SHA1
d4bbac78c2844ef242d22a80810662e8ca4b5d90

SHA256
3bd3572b1156e306e9e57d99bb6923669d614b37e5b4453ce4224bed2f3eaa04

SHA512
1685c751a711266154eeae88201367421b709ab879584fecf1f172c99cdede11c4cdc6237f18f6f2ffdd84728ebb87206473174e0a68ea9dc06fbc4947b688f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61832.exe

Filesize
468KB

MD5
c4b3d3f6822d58b39547f1944f870460

SHA1
83816a03a967c4fcee0b25b1515d8a1f1105428e

SHA256
3f3a982224f0a952d4425a92784cad303eb48d21f63b3dcd8411b1cfe0885997

SHA512
1783af27e0f7038f72a2e27f83cf26bf82e68bdf4c864c1e3613db1b286c9352c88412a00fe8caa20d8f5fc1388d81ba73371630f559d01fc36f291ac0f73f46

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe

Filesize
468KB

MD5
35faa57853f2a80b736616f33d3c9f7f

SHA1
90bfcf49b81457087cc5f066cef546cfedbd794e

SHA256
0c53b2259939cb71d83a320dd59970b733cb01fe03d25b20e216e9663c7fa04c

SHA512
6f8fb3e9ed8c0f864c92927c40594aa6ecc4306a55ead4f33aa8c7c512c1618f753296b8079f19c06ca8f9f27878723f97e97f4d48c88b2bd6460ec14fb61730

Download Submit