355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
Size

468KB
MD5

39adf2e431e84dc70bbd263f66898dc0
SHA1

3f067eba94f92f7f4b36302f69fa9a1e801959c8
SHA256

355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312
SHA512

39f9a6fefe85189553ae497796da10a6c824a51c5e5073adb6eee3933c7a6a1b081382c95416a0ae5372f8cdd5b6319801f814cfd1a37d4b71ad98f0d7bda096
SSDEEP

3072:VErDogIdI35YqbYaPzUTffC/gCHC7OphVEHhEVc4ipGLsI5DHiln:VEHowJYq5PATffHe8qipIx5DH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2888	Unicorn-48835.exe
2524	Unicorn-7792.exe
2300	Unicorn-38196.exe
2820	Unicorn-13755.exe
2616	Unicorn-62271.exe
2892	Unicorn-42405.exe
2796	Unicorn-23468.exe
2880	Unicorn-33437.exe
2032	Unicorn-59975.exe
1924	Unicorn-32093.exe
1584	Unicorn-12035.exe
476	Unicorn-14992.exe
2160	Unicorn-31901.exe
1720	Unicorn-21123.exe
1388	Unicorn-55476.exe
2668	Unicorn-51787.exe
2704	Unicorn-64978.exe
2452	Unicorn-26318.exe
1716	Unicorn-34494.exe
2792	Unicorn-44465.exe
672	Unicorn-11792.exe
1120	Unicorn-7578.exe
1448	Unicorn-51954.exe
1828	Unicorn-28404.exe
1680	Unicorn-45233.exe
572	Unicorn-28212.exe
2336	Unicorn-22081.exe
1896	Unicorn-21117.exe
776	Unicorn-6042.exe
3020	Unicorn-58507.exe
880	Unicorn-46876.exe
1108	Unicorn-29855.exe
2692	Unicorn-12703.exe
2504	Unicorn-26438.exe
1240	Unicorn-12475.exe
2700	Unicorn-41125.exe
2480	Unicorn-29087.exe
2964	Unicorn-31209.exe
2488	Unicorn-64914.exe
2724	Unicorn-46502.exe
2636	Unicorn-33503.exe
2512	Unicorn-52988.exe
1992	Unicorn-52984.exe
2432	Unicorn-5739.exe
584	Unicorn-21080.exe
1432	Unicorn-27442.exe
1824	Unicorn-6004.exe
352	Unicorn-6004.exe
1684	Unicorn-14561.exe
1872	Unicorn-29064.exe
1216	Unicorn-65193.exe
2972	Unicorn-23384.exe
1044	Unicorn-23384.exe
2676	Unicorn-3518.exe
1708	Unicorn-35204.exe
2588	Unicorn-19745.exe
1284	Unicorn-39611.exe
2040	Unicorn-64233.exe
2696	Unicorn-34173.exe
1768	Unicorn-301.exe
1444	Unicorn-20167.exe
752	Unicorn-12771.exe
2528	Unicorn-1152.exe
2412	Unicorn-21018.exe

Loads dropped DLL 64 IoCs

pid	Process
2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
2888	Unicorn-48835.exe
2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
2888	Unicorn-48835.exe
2524	Unicorn-7792.exe
2524	Unicorn-7792.exe
2300	Unicorn-38196.exe
2300	Unicorn-38196.exe
2888	Unicorn-48835.exe
2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
2888	Unicorn-48835.exe
2820	Unicorn-13755.exe
2820	Unicorn-13755.exe
2524	Unicorn-7792.exe
2524	Unicorn-7792.exe
2616	Unicorn-62271.exe
2616	Unicorn-62271.exe
2300	Unicorn-38196.exe
2300	Unicorn-38196.exe
2892	Unicorn-42405.exe
2888	Unicorn-48835.exe
2892	Unicorn-42405.exe
2796	Unicorn-23468.exe
2888	Unicorn-48835.exe
2796	Unicorn-23468.exe
2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
2880	Unicorn-33437.exe
2880	Unicorn-33437.exe
2820	Unicorn-13755.exe
2820	Unicorn-13755.exe
2032	Unicorn-59975.exe
2032	Unicorn-59975.exe
2524	Unicorn-7792.exe
2524	Unicorn-7792.exe
1720	Unicorn-21123.exe
1720	Unicorn-21123.exe
1388	Unicorn-55476.exe
1388	Unicorn-55476.exe
2796	Unicorn-23468.exe
2796	Unicorn-23468.exe
2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
1584	Unicorn-12035.exe
2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
1584	Unicorn-12035.exe
1924	Unicorn-32093.exe
1924	Unicorn-32093.exe
476	Unicorn-14992.exe
476	Unicorn-14992.exe
2300	Unicorn-38196.exe
2300	Unicorn-38196.exe
2892	Unicorn-42405.exe
2892	Unicorn-42405.exe
2616	Unicorn-62271.exe
2616	Unicorn-62271.exe
2888	Unicorn-48835.exe
2888	Unicorn-48835.exe
2668	Unicorn-51787.exe
2668	Unicorn-51787.exe
2704	Unicorn-64978.exe
2704	Unicorn-64978.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1632	1824	WerFault.exe	78
2812	352	WerFault.exe	77
2388	2480	WerFault.exe	67

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25864.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
2888	Unicorn-48835.exe
2524	Unicorn-7792.exe
2300	Unicorn-38196.exe
2820	Unicorn-13755.exe
2616	Unicorn-62271.exe
2892	Unicorn-42405.exe
2796	Unicorn-23468.exe
2880	Unicorn-33437.exe
2032	Unicorn-59975.exe
1924	Unicorn-32093.exe
2160	Unicorn-31901.exe
1720	Unicorn-21123.exe
476	Unicorn-14992.exe
1584	Unicorn-12035.exe
1388	Unicorn-55476.exe
2668	Unicorn-51787.exe
2704	Unicorn-64978.exe
2452	Unicorn-26318.exe
1716	Unicorn-34494.exe
672	Unicorn-11792.exe
2792	Unicorn-44465.exe
1120	Unicorn-7578.exe
1448	Unicorn-51954.exe
572	Unicorn-28212.exe
1828	Unicorn-28404.exe
1680	Unicorn-45233.exe
2336	Unicorn-22081.exe
1896	Unicorn-21117.exe
3020	Unicorn-58507.exe
776	Unicorn-6042.exe
880	Unicorn-46876.exe
1108	Unicorn-29855.exe
1240	Unicorn-12475.exe
2504	Unicorn-26438.exe
2692	Unicorn-12703.exe
2700	Unicorn-41125.exe
2964	Unicorn-31209.exe
2480	Unicorn-29087.exe
2488	Unicorn-64914.exe
2724	Unicorn-46502.exe
2636	Unicorn-33503.exe
2512	Unicorn-52988.exe
1992	Unicorn-52984.exe
584	Unicorn-21080.exe
2432	Unicorn-5739.exe
1432	Unicorn-27442.exe
1824	Unicorn-6004.exe
1684	Unicorn-14561.exe
352	Unicorn-6004.exe
1872	Unicorn-29064.exe
1216	Unicorn-65193.exe
2972	Unicorn-23384.exe
2676	Unicorn-3518.exe
1044	Unicorn-23384.exe
1708	Unicorn-35204.exe
2588	Unicorn-19745.exe
1284	Unicorn-39611.exe
2040	Unicorn-64233.exe
2696	Unicorn-34173.exe
1444	Unicorn-20167.exe
1768	Unicorn-301.exe
752	Unicorn-12771.exe
2528	Unicorn-1152.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2888	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	30
PID 2496 wrote to memory of 2888	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	30
PID 2496 wrote to memory of 2888	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	30
PID 2496 wrote to memory of 2888	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	30
PID 2496 wrote to memory of 2300	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	32
PID 2496 wrote to memory of 2300	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	32
PID 2496 wrote to memory of 2300	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	32
PID 2496 wrote to memory of 2300	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	32
PID 2888 wrote to memory of 2524	2888	Unicorn-48835.exe	31
PID 2888 wrote to memory of 2524	2888	Unicorn-48835.exe	31
PID 2888 wrote to memory of 2524	2888	Unicorn-48835.exe	31
PID 2888 wrote to memory of 2524	2888	Unicorn-48835.exe	31
PID 2524 wrote to memory of 2820	2524	Unicorn-7792.exe	33
PID 2524 wrote to memory of 2820	2524	Unicorn-7792.exe	33
PID 2524 wrote to memory of 2820	2524	Unicorn-7792.exe	33
PID 2524 wrote to memory of 2820	2524	Unicorn-7792.exe	33
PID 2300 wrote to memory of 2616	2300	Unicorn-38196.exe	34
PID 2300 wrote to memory of 2616	2300	Unicorn-38196.exe	34
PID 2300 wrote to memory of 2616	2300	Unicorn-38196.exe	34
PID 2300 wrote to memory of 2616	2300	Unicorn-38196.exe	34
PID 2496 wrote to memory of 2796	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	36
PID 2496 wrote to memory of 2796	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	36
PID 2496 wrote to memory of 2796	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	36
PID 2496 wrote to memory of 2796	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	36
PID 2888 wrote to memory of 2892	2888	Unicorn-48835.exe	35
PID 2888 wrote to memory of 2892	2888	Unicorn-48835.exe	35
PID 2888 wrote to memory of 2892	2888	Unicorn-48835.exe	35
PID 2888 wrote to memory of 2892	2888	Unicorn-48835.exe	35
PID 2820 wrote to memory of 2880	2820	Unicorn-13755.exe	38
PID 2820 wrote to memory of 2880	2820	Unicorn-13755.exe	38
PID 2820 wrote to memory of 2880	2820	Unicorn-13755.exe	38
PID 2820 wrote to memory of 2880	2820	Unicorn-13755.exe	38
PID 2524 wrote to memory of 2032	2524	Unicorn-7792.exe	39
PID 2524 wrote to memory of 2032	2524	Unicorn-7792.exe	39
PID 2524 wrote to memory of 2032	2524	Unicorn-7792.exe	39
PID 2524 wrote to memory of 2032	2524	Unicorn-7792.exe	39
PID 2616 wrote to memory of 1924	2616	Unicorn-62271.exe	40
PID 2616 wrote to memory of 1924	2616	Unicorn-62271.exe	40
PID 2616 wrote to memory of 1924	2616	Unicorn-62271.exe	40
PID 2616 wrote to memory of 1924	2616	Unicorn-62271.exe	40
PID 2300 wrote to memory of 1584	2300	Unicorn-38196.exe	41
PID 2300 wrote to memory of 1584	2300	Unicorn-38196.exe	41
PID 2300 wrote to memory of 1584	2300	Unicorn-38196.exe	41
PID 2300 wrote to memory of 1584	2300	Unicorn-38196.exe	41
PID 2892 wrote to memory of 2160	2892	Unicorn-42405.exe	42
PID 2892 wrote to memory of 2160	2892	Unicorn-42405.exe	42
PID 2892 wrote to memory of 2160	2892	Unicorn-42405.exe	42
PID 2892 wrote to memory of 2160	2892	Unicorn-42405.exe	42
PID 2888 wrote to memory of 476	2888	Unicorn-48835.exe	43
PID 2888 wrote to memory of 476	2888	Unicorn-48835.exe	43
PID 2888 wrote to memory of 476	2888	Unicorn-48835.exe	43
PID 2888 wrote to memory of 476	2888	Unicorn-48835.exe	43
PID 2796 wrote to memory of 1720	2796	Unicorn-23468.exe	44
PID 2796 wrote to memory of 1720	2796	Unicorn-23468.exe	44
PID 2796 wrote to memory of 1720	2796	Unicorn-23468.exe	44
PID 2796 wrote to memory of 1720	2796	Unicorn-23468.exe	44
PID 2496 wrote to memory of 1388	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	45
PID 2496 wrote to memory of 1388	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	45
PID 2496 wrote to memory of 1388	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	45
PID 2496 wrote to memory of 1388	2496	355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe	45
PID 2880 wrote to memory of 2668	2880	Unicorn-33437.exe	46
PID 2880 wrote to memory of 2668	2880	Unicorn-33437.exe	46
PID 2880 wrote to memory of 2668	2880	Unicorn-33437.exe	46
PID 2880 wrote to memory of 2668	2880	Unicorn-33437.exe	46

C:\Users\Admin\AppData\Local\Temp\355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe
"C:\Users\Admin\AppData\Local\Temp\355d248647035f246dda30c47da8a40f033833c7303c4b6f72b8b1a7839ad312N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34173.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        9⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
        9⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
        9⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        9⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
        8⤵
        
        PID:280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38914.exe
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
        8⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-301.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        8⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57506.exe
        9⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        8⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46527.exe
        8⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61532.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        7⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        7⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35182.exe
        8⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38389.exe
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        8⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
        7⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
        7⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2547.exe
        6⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10362.exe
        7⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41025.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48798.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43607.exe
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        7⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        7⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        7⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5515.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
        6⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        8⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15178.exe
        8⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe
        7⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12771.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        8⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        8⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46527.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        8⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        7⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
        6⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37891.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26438.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4764.exe
        6⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49354.exe
        7⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7785.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        7⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61009.exe
        6⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58747.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        5⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
        6⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37223.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22058.exe
        5⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5515.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
        7⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        8⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36763.exe
        8⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        8⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        8⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        7⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1152.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        7⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39819.exe
        8⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18788.exe
        8⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        8⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        7⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
        6⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        7⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
        6⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41125.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21018.exe
        6⤵
        Executes dropped EXE
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
        7⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7785.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
        6⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64171.exe
        5⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        6⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38389.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
        5⤵
        
        PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53112.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        5⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37891.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29087.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 240
        6⤵
        Program crash
        
        PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        5⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        5⤵
        
        PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48633.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37891.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31209.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        5⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
      4⤵
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44850.exe
        5⤵
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
      4⤵
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9782.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40532.exe
      4⤵
      PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
      4⤵
      PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9766.exe
      4⤵
      PID:6912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42405.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
        6⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        7⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        7⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        7⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        6⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3653.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
        6⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54135.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
        5⤵
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20546.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21117.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39611.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20627.exe
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44515.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe
        7⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        6⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56034.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61533.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21326.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10664.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        5⤵
        
        PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
        5⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36257.exe
      4⤵
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-302.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24612.exe
      4⤵
      PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
      4⤵
      PID:6460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23384.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        6⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
        7⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
        7⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28314.exe
        7⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        6⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12775.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        5⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1580.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        5⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19745.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52104.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        6⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10713.exe
        5⤵
        
        PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34413.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
      4⤵
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      4⤵
      PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
      4⤵
      PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:352
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 200
        5⤵
        Program crash
        
        PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
      4⤵
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
      4⤵
      PID:828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
      4⤵
      PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
      4⤵
      PID:6960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27442.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
      4⤵
      PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63912.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61999.exe
        5⤵
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12052.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
      4⤵
      PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
    3⤵
    PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
      4⤵
      PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe
      4⤵
      PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exe
    3⤵
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53788.exe
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35197.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30993.exe
    3⤵
    PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
    3⤵
    PID:6920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62271.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23384.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        7⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        7⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-150.exe
        8⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        8⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61533.exe
        7⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21326.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        7⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        6⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        7⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        7⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        6⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        6⤵
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        6⤵
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        7⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65169.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
        5⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47259.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9252.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44997.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6042.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        5⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
        5⤵
        
        PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        5⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4388.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        5⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        5⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36257.exe
      4⤵
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34413.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38706.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23988.exe
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24612.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
      4⤵
      PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
      4⤵
      PID:6620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 200
        6⤵
        Program crash
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
        5⤵
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60263.exe
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
      4⤵
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe
        5⤵
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4801.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      4⤵
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
      4⤵
      PID:7008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22081.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        5⤵
        
        PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4388.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        5⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37891.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
      4⤵
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39583.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
      4⤵
      PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
      4⤵
      PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
      4⤵
      PID:7112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5739.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
      4⤵
      PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
      4⤵
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58747.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
      4⤵
      PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exe
    3⤵
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11194.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36703.exe
    3⤵
    PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22714.exe
    3⤵
    PID:7084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44465.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        5⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        5⤵
        
        PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        5⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
        5⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3518.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        5⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49619.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12052.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
        5⤵
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
        5⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        5⤵
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      4⤵
      PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
      4⤵
      PID:5816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21080.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53274.exe
        5⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38146.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53284.exe
      4⤵
      PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1541.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
      4⤵
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
      4⤵
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4839.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26502.exe
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47699.exe
    3⤵
    PID:3932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
    3⤵
    PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
    3⤵
    PID:5280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55476.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55476.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        5⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        6⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
        6⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
        5⤵
        
        PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
        5⤵
        
        PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45683.exe
      4⤵
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
      4⤵
      PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
      4⤵
      PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61867.exe
    3⤵
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5649.exe
      4⤵
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49092.exe
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
      4⤵
      PID:6984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30724.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
    3⤵
    PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
    3⤵
    PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
    3⤵
    PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
    3⤵
    PID:7048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33503.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
      4⤵
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        5⤵
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59485.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
        5⤵
        
        PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
      4⤵
      PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
      4⤵
      PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
      4⤵
      PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56653.exe
    3⤵
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
      4⤵
      PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59485.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
      4⤵
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
      4⤵
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35210.exe
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
      4⤵
      PID:6416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exe
    3⤵
    PID:5988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64689.exe
    3⤵
    PID:6772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
    3⤵
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
      4⤵
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe
    3⤵
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
    3⤵
    PID:3560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
    3⤵
    PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
    3⤵
    PID:7004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28122.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28122.exe
  2⤵
  PID:2976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
    3⤵
    PID:6544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
  2⤵
  PID:532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48453.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48453.exe
  2⤵
  PID:3572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
  2⤵
  PID:4568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
  2⤵
  PID:6928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe

Filesize
468KB

MD5
cbce2d458a62fc6fac456c35bf2f6613

SHA1
45a7b485311440a0e5288dcf71262a636d9dc43f

SHA256
464849594186d5929de3ae6f82dd20d185a58d74f0e6b36da53934bd6e86fa7c

SHA512
a79bd4d1e30283346b94f30eb0e15f9a8ae5f525c0fb10d464611d2d2db42deab8f661e4ef54c472eed716ba425762bf60b7fca0e1e4489b225859ff6ae30aa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe

Filesize
468KB

MD5
c0d46f67c10a08af3128170589391e5b

SHA1
0dbc27c2d735aa7170d856482cd4da6e60467cc5

SHA256
a9b3a7f55240e9f973ef437da20c65dc5a60134e69c319aba9be327070c538f5

SHA512
9841faa82fdbd6392d4d89e9cb4b3b6cb1cbb4e247594bb47ca7c72f998c1a43bae3ff29fe1c2b3c60b578ca658e93a55d338ea5da361160e18c26dc6f7723c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe

Filesize
468KB

MD5
dfff3f1166e7434916f8ed15731870b4

SHA1
c212a04944a56e3292f42f4e6c89f01779d9761a

SHA256
9e7d3001ee8782cdbff27a5fbd593a89e7230706e9bd2328bf24053fd0326c02

SHA512
27e2c66480c70a41e2a90a37631b685e547ae72173548017cfe6567aac6258fb289474b46768411801aac1de8b1e7ceee8a636bc89f507fc6c78eacb7d7d8290

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe

Filesize
468KB

MD5
8d50c5a563774a144bf14176f6f7e5aa

SHA1
73064e0fad3d83ca5bae665cc1f9e9645abee64d

SHA256
1304097ad9fdfa6716ee4d7ec406ff2c720c65cc2adc79476d75131bcf474277

SHA512
31af798c2d04ba2cb7d7e390e4027f25d738ef4f30f6e8f9f58ac735e9f006cdcfa3d22350ece7e446f8c3dff98a3d7f3f599bc3642f601b905ba5ef8d130185

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe

Filesize
468KB

MD5
9bc15175a78ce2fb2e264204eadaaa40

SHA1
51ef5ed0c15e7e89d95fbd7262f447b93012c84a

SHA256
1a405e53f9f741fd30031a017ebf96a812b4a49e68b7c88c69789d337dd64a82

SHA512
5e4959a961216e86e599a75cb5da40dc78ede4206e2b5bad79a8f329eeb9be08f1edb1628b8bb60d96c224969f78cbbeb42e543204908a164dd20bcb07c56279

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55476.exe

Filesize
468KB

MD5
55bd18f9f59181336acce4c7b226e40f

SHA1
93d4db23ba73df9991021452ca64defb3c8c1929

SHA256
5f4fca4af7c547176860673a9810929f113273a18135713d380ef91a87947823

SHA512
7354e5d463ce2456a626dbb2271cf27d6c5b89b395559de0fef8fb12b54f1aa768ebc11abd92f029aa38cf335be39c782cfedc922ac861e966a6816ca9c74222

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62271.exe

Filesize
468KB

MD5
3b8454a446c17152d564dfb0a16b141c

SHA1
6a8ee31281ad20c5eda61e5e79fc38beda108603

SHA256
a2c5a6c9bf7676211dad4a05dcb56d20ea65ffde3645b4782bedb0c21d3a35f5

SHA512
c48f9a04a4ee870a70d618d54442278b024d7901150c6a910cae74b3914afef57fb11883a31817df3d678c0784bf6b84e71192722859ce6a624bc57ed6f8f662

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe

Filesize
468KB

MD5
f88b71f151a46ea2fd28ee6d5758c347

SHA1
84a1adabca57939be90cdbc49c10234f0833d300

SHA256
3a50333a49fe66e6e2f1b99b148dcf1fbddb99f9839722f34c85b2c2c3f5f8dd

SHA512
d94b01261074176fd59d3aa696e182fe1f6cb1a5184a0981287e6e98c74c70f36c603db58043e5268568fa817060e946812aadf6e5ef75f98ff58e775cb54626

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe

Filesize
468KB

MD5
d8d11926359786bfdf9e5b3faf6f47ca

SHA1
2a24434063e4806ca54d469afc38dac3cd151641

SHA256
f3ffc228fb7aecfd2a95ee45801a33bbb372c8941fe71601802e3e4df53373d4

SHA512
3814b3ba70df46caf9221e7ca91ea23475a128bb68a9e163724be317cef3b877a4514f05dd2f89c7ba71f7ee1091fba272fbd2fcad9e8ffa66a7330b7f1935db

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe

Filesize
468KB

MD5
7ab3411682c5d4d8fd3aa3f09a10c670

SHA1
7ff3424150d209b885d1fda28592368ae94b28d8

SHA256
f1604464b2a091ebfd2bcf229a4385052ef0f13c1a7ea7fdeceaa5f771f36739

SHA512
e347a16f4600e242fc93d14b472b6582fb2a2d1dfc151f0f49e56e93ce09f0ab4f3330a2ab89a9834dfc74099e2c97a72e77ef046d1dca1325bbcfa62026f0c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe

Filesize
468KB

MD5
4f4d2c0fd5eb68b4de5b915e17917686

SHA1
bfcaa25b9e156c095b04a209b6b8171fd2ec9895

SHA256
623ab16ab64c8b9ec38a0a33b202ceedd07e6e826d5ef8749cef344b851f66a5

SHA512
078daae272b3aad9ff875429b5fcbe821ace42b6784c2a3ee28be1814f4383d8e8d94c5843bdb2452f0e8e1cf159c8d238bfb1470dec4c1779c0404dc161c887

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe

Filesize
468KB

MD5
bb30fa01ad577abd510e749de71d8eb9

SHA1
cd0f0783120ff41496827766e3331eba24c2aeab

SHA256
17c5c6c26565e1def10e5a77d183537487942b83765a75556cd8493a4db2093b

SHA512
e39516655ac8e19eeec5e8d70697130b5bc3a810588e2359e18314e7133e9a637a7885d1b341fe11095a2502c7e0a29b815cc498c67e56d78cea60134fdf810e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe

Filesize
468KB

MD5
bbd20f68fbc451375791c97f9617b0da

SHA1
6365dbf065f5d81438c9ab5a1aa31c9d7674574d

SHA256
8ce11aa360f1d99c83e2c4baaae6f69ea72b23a211a4111c4b74e44ad08fef47

SHA512
ed42f860e932d3885487981d63364b49bf94e8701cb9bc7561d3f3dae6120a7ce1d3a5d7e79a7ab350263c9812f7ee7a2e0fb7006981cf056258ef930707f92f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe

Filesize
468KB

MD5
31ca32d17c203e648637aac6574d70d3

SHA1
c9b1f59baea7f41065881d51dc63eb5fa62102ff

SHA256
9ad95cfb0fd7367e589b52a14f4f8846dbf87b3efebda5babf900c2e4eaae11e

SHA512
5d04358775d2fafc89bb3a02b3c8d82993b565600bbb18fa8b03ad7b286733ba255254c23bd0f5be40438d733ed15e2d57c6bea4205b7bfd26c9677cd900302e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe

Filesize
468KB

MD5
03c2c00dc8f3815912183038bf1ed8c7

SHA1
f82c9eb45ecb58b41a4d5f1cd66b2e78c20fa85f

SHA256
6da244d21f8af15aa603277e186e00ca6208e9128cec10917be07e148c0b2f55

SHA512
83f7715dc5bda20fd2fc78c4c00d74339429922a5400129cc016b061d6bb7d73c4f76564d47d01b8db1510f8ba7bf1dd433ca927da721011d874041707913ba5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42405.exe

Filesize
468KB

MD5
3df7455cccd0e04349d2fce096e56d06

SHA1
146fa641777a2c741feb1fbe43a0236b98c557e8

SHA256
5da4deb70f3f38e049034c8ec27ba9628d139d37c76f644af0a14bb5d63e30c4

SHA512
febc77d5016dff40bc9a45877f7d102fbb61b18ea5efeec5894efe7d99d4aba0cbf2c1f59dff2eaa61be548c0d770b0334c131d096e3467a0d0986776f2f0331

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe

Filesize
468KB

MD5
589a724382a54b025dc3ed656225347b

SHA1
7800cb93076dcecc5435ce79c7751933b653813b

SHA256
dcbadbd861c6b8367170e6e5d7f6f4b3ec474bebc0259ec725d9d55e46c33019

SHA512
28601b7c6487d5e86836290a4bd2c57762b9623ad062789b8fc11921641271f136deab3f7c88cab016cad6d87e462d08880b8007fc83b870413f4a5cbcf56703

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe

Filesize
468KB

MD5
77514b8c7b79e370383ea12a41508283

SHA1
cc1430c1d4170af902c53114c1111127e2104004

SHA256
a2d23cab9a02d23d11183538502feba55745bde257af0e23be05bb57f2010a4e

SHA512
92898cad8e5a82e6d11a23ec71d2d2f19a8507ddeff4b004302094a6dc5f7913f953f013c3f1a68ebe90b59001870e845e46787e9013b8c2b89878db5f48ab7c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe

Filesize
468KB

MD5
445584280901a6129d7f811535c208bc

SHA1
cfd67ac8d018e5165160e858eafa782a8c3b2196

SHA256
547c03df88e3b502ff1885348eed69864ad63bddb436a072830df08d1ac88d3f

SHA512
218fdbf81e7abc326a426f19aa1bd4531533aeec78a1aca4b2b21377e880e8667574155906416f4861f48e04d70187081f7968f435a94d7fb2f81cb3351caa35

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe

Filesize
468KB

MD5
3c98dc3c005ac331b0b46b3d58ed5756

SHA1
b96bac38183ed3543cb86149ef3c9aafcc9f6372

SHA256
fc2144d1a0f807bb9484e0e1db464a791b683031063c39880eb7262d451074d4

SHA512
2942e53ac4c89df0fc61b893580e2e1114fd5eaf1dce4aa18f0040ba4ec8562cea38efa4c4e551f0d9b80749ee82b02eae6e62a58ea15a87b65ccac5e1167e63

Download Submit