3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382ad

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11/10/2024, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
Size

468KB
MD5

2c0985886058c8feae21a83c7c344b20
SHA1

3474df9e0089b39084e5a3620f42a94ce5185459
SHA256

3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382ad
SHA512

372b11e28ccb442dfad53ada84e33cdf794ecba7b09baa298472442578f0347edfd98d7884dc154d3963aa7384fc4c7308fc724ca51054b80fd4757adbfa0cf6
SSDEEP

3072:noCkovIuU35/t7YNPgH5OfQb+5RM6Fe+lmHdajCzMY3QqFQclnlz:no1ouJ/tuPu5OfH0h3MYAyQcl

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2328	Unicorn-36885.exe
2508	Unicorn-9871.exe
2412	Unicorn-41989.exe
2896	Unicorn-58408.exe
2684	Unicorn-46156.exe
2980	Unicorn-31857.exe
2176	Unicorn-18122.exe
2732	Unicorn-17651.exe
2036	Unicorn-63343.exe
2908	Unicorn-12751.exe
2564	Unicorn-49508.exe
1724	Unicorn-61205.exe
2960	Unicorn-32160.exe
3024	Unicorn-32425.exe
2932	Unicorn-26294.exe
2120	Unicorn-52051.exe
2056	Unicorn-21325.exe
1256	Unicorn-57266.exe
908	Unicorn-40929.exe
2208	Unicorn-60795.exe
1132	Unicorn-60795.exe
448	Unicorn-60530.exe
1320	Unicorn-40183.exe
1260	Unicorn-31252.exe
1600	Unicorn-40183.exe
1684	Unicorn-29554.exe
984	Unicorn-5372.exe
1524	Unicorn-8479.exe
2180	Unicorn-44359.exe
2236	Unicorn-50489.exe
2220	Unicorn-52990.exe
580	Unicorn-37744.exe
2516	Unicorn-63571.exe
1476	Unicorn-17900.exe
1712	Unicorn-65517.exe
2504	Unicorn-19654.exe
2064	Unicorn-50380.exe
2780	Unicorn-42212.exe
2876	Unicorn-17521.exe
2828	Unicorn-46964.exe
2868	Unicorn-37312.exe
1988	Unicorn-22368.exe
3052	Unicorn-44926.exe
2844	Unicorn-44926.exe
2676	Unicorn-14199.exe
2084	Unicorn-25490.exe
2796	Unicorn-15880.exe
2852	Unicorn-16146.exe
3012	Unicorn-38439.exe
1568	Unicorn-38704.exe
2024	Unicorn-54940.exe
2744	Unicorn-61070.exe
1728	Unicorn-28952.exe
1604	Unicorn-8340.exe
2284	Unicorn-172.exe
2484	Unicorn-50764.exe
2248	Unicorn-20038.exe
1720	Unicorn-17240.exe
1632	Unicorn-30975.exe
1472	Unicorn-37106.exe
956	Unicorn-45174.exe
2464	Unicorn-24169.exe
756	Unicorn-26861.exe
1528	Unicorn-42643.exe

Loads dropped DLL 64 IoCs

pid	Process
2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
2328	Unicorn-36885.exe
2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
2328	Unicorn-36885.exe
2412	Unicorn-41989.exe
2412	Unicorn-41989.exe
2508	Unicorn-9871.exe
2508	Unicorn-9871.exe
2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
2328	Unicorn-36885.exe
2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
2328	Unicorn-36885.exe
2896	Unicorn-58408.exe
2896	Unicorn-58408.exe
2412	Unicorn-41989.exe
2684	Unicorn-46156.exe
2684	Unicorn-46156.exe
2412	Unicorn-41989.exe
2508	Unicorn-9871.exe
2508	Unicorn-9871.exe
2980	Unicorn-31857.exe
2980	Unicorn-31857.exe
2328	Unicorn-36885.exe
2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
2176	Unicorn-18122.exe
2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
2176	Unicorn-18122.exe
2328	Unicorn-36885.exe
2036	Unicorn-63343.exe
2732	Unicorn-17651.exe
2036	Unicorn-63343.exe
2732	Unicorn-17651.exe
2684	Unicorn-46156.exe
2684	Unicorn-46156.exe
2896	Unicorn-58408.exe
2328	Unicorn-36885.exe
2932	Unicorn-26294.exe
2960	Unicorn-32160.exe
2896	Unicorn-58408.exe
2960	Unicorn-32160.exe
2328	Unicorn-36885.exe
2932	Unicorn-26294.exe
2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
1724	Unicorn-61205.exe
2908	Unicorn-12751.exe
1724	Unicorn-61205.exe
2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
2908	Unicorn-12751.exe
2980	Unicorn-31857.exe
2980	Unicorn-31857.exe
2564	Unicorn-49508.exe
2564	Unicorn-49508.exe
2412	Unicorn-41989.exe
2412	Unicorn-41989.exe
2508	Unicorn-9871.exe
2508	Unicorn-9871.exe
3024	Unicorn-32425.exe
3024	Unicorn-32425.exe
2176	Unicorn-18122.exe
2176	Unicorn-18122.exe
2120	Unicorn-52051.exe
2120	Unicorn-52051.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1796	2516	WerFault.exe	64

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-83.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18798.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
2328	Unicorn-36885.exe
2508	Unicorn-9871.exe
2412	Unicorn-41989.exe
2896	Unicorn-58408.exe
2684	Unicorn-46156.exe
2980	Unicorn-31857.exe
2176	Unicorn-18122.exe
2732	Unicorn-17651.exe
2908	Unicorn-12751.exe
2036	Unicorn-63343.exe
1724	Unicorn-61205.exe
2960	Unicorn-32160.exe
2564	Unicorn-49508.exe
3024	Unicorn-32425.exe
2932	Unicorn-26294.exe
2120	Unicorn-52051.exe
2056	Unicorn-21325.exe
2208	Unicorn-60795.exe
1256	Unicorn-57266.exe
1132	Unicorn-60795.exe
908	Unicorn-40929.exe
448	Unicorn-60530.exe
1600	Unicorn-40183.exe
1260	Unicorn-31252.exe
1320	Unicorn-40183.exe
1524	Unicorn-8479.exe
1684	Unicorn-29554.exe
984	Unicorn-5372.exe
2180	Unicorn-44359.exe
2236	Unicorn-50489.exe
2220	Unicorn-52990.exe
580	Unicorn-37744.exe
2516	Unicorn-63571.exe
1476	Unicorn-17900.exe
1712	Unicorn-65517.exe
2504	Unicorn-19654.exe
2064	Unicorn-50380.exe
2780	Unicorn-42212.exe
2876	Unicorn-17521.exe
2828	Unicorn-46964.exe
2868	Unicorn-37312.exe
1988	Unicorn-22368.exe
2844	Unicorn-44926.exe
3052	Unicorn-44926.exe
2676	Unicorn-14199.exe
2084	Unicorn-25490.exe
2796	Unicorn-15880.exe
2852	Unicorn-16146.exe
3012	Unicorn-38439.exe
1568	Unicorn-38704.exe
2024	Unicorn-54940.exe
2744	Unicorn-61070.exe
1604	Unicorn-8340.exe
2484	Unicorn-50764.exe
2248	Unicorn-20038.exe
1728	Unicorn-28952.exe
2284	Unicorn-172.exe
1720	Unicorn-17240.exe
1632	Unicorn-30975.exe
956	Unicorn-45174.exe
1472	Unicorn-37106.exe
2272	Unicorn-42643.exe
2464	Unicorn-24169.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2328	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	31
PID 2652 wrote to memory of 2328	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	31
PID 2652 wrote to memory of 2328	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	31
PID 2652 wrote to memory of 2328	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	31
PID 2652 wrote to memory of 2508	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	33
PID 2652 wrote to memory of 2508	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	33
PID 2652 wrote to memory of 2508	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	33
PID 2652 wrote to memory of 2508	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	33
PID 2328 wrote to memory of 2412	2328	Unicorn-36885.exe	32
PID 2328 wrote to memory of 2412	2328	Unicorn-36885.exe	32
PID 2328 wrote to memory of 2412	2328	Unicorn-36885.exe	32
PID 2328 wrote to memory of 2412	2328	Unicorn-36885.exe	32
PID 2412 wrote to memory of 2896	2412	Unicorn-41989.exe	34
PID 2412 wrote to memory of 2896	2412	Unicorn-41989.exe	34
PID 2412 wrote to memory of 2896	2412	Unicorn-41989.exe	34
PID 2412 wrote to memory of 2896	2412	Unicorn-41989.exe	34
PID 2508 wrote to memory of 2684	2508	Unicorn-9871.exe	35
PID 2508 wrote to memory of 2684	2508	Unicorn-9871.exe	35
PID 2508 wrote to memory of 2684	2508	Unicorn-9871.exe	35
PID 2508 wrote to memory of 2684	2508	Unicorn-9871.exe	35
PID 2652 wrote to memory of 2980	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	36
PID 2652 wrote to memory of 2980	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	36
PID 2652 wrote to memory of 2980	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	36
PID 2652 wrote to memory of 2980	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	36
PID 2328 wrote to memory of 2176	2328	Unicorn-36885.exe	37
PID 2328 wrote to memory of 2176	2328	Unicorn-36885.exe	37
PID 2328 wrote to memory of 2176	2328	Unicorn-36885.exe	37
PID 2328 wrote to memory of 2176	2328	Unicorn-36885.exe	37
PID 2896 wrote to memory of 2732	2896	Unicorn-58408.exe	38
PID 2896 wrote to memory of 2732	2896	Unicorn-58408.exe	38
PID 2896 wrote to memory of 2732	2896	Unicorn-58408.exe	38
PID 2896 wrote to memory of 2732	2896	Unicorn-58408.exe	38
PID 2684 wrote to memory of 2036	2684	Unicorn-46156.exe	40
PID 2684 wrote to memory of 2036	2684	Unicorn-46156.exe	40
PID 2684 wrote to memory of 2036	2684	Unicorn-46156.exe	40
PID 2684 wrote to memory of 2036	2684	Unicorn-46156.exe	40
PID 2412 wrote to memory of 2908	2412	Unicorn-41989.exe	39
PID 2412 wrote to memory of 2908	2412	Unicorn-41989.exe	39
PID 2412 wrote to memory of 2908	2412	Unicorn-41989.exe	39
PID 2412 wrote to memory of 2908	2412	Unicorn-41989.exe	39
PID 2508 wrote to memory of 2564	2508	Unicorn-9871.exe	41
PID 2508 wrote to memory of 2564	2508	Unicorn-9871.exe	41
PID 2508 wrote to memory of 2564	2508	Unicorn-9871.exe	41
PID 2508 wrote to memory of 2564	2508	Unicorn-9871.exe	41
PID 2980 wrote to memory of 1724	2980	Unicorn-31857.exe	42
PID 2980 wrote to memory of 1724	2980	Unicorn-31857.exe	42
PID 2980 wrote to memory of 1724	2980	Unicorn-31857.exe	42
PID 2980 wrote to memory of 1724	2980	Unicorn-31857.exe	42
PID 2652 wrote to memory of 2960	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	44
PID 2652 wrote to memory of 2960	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	44
PID 2652 wrote to memory of 2960	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	44
PID 2652 wrote to memory of 2960	2652	3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe	44
PID 2176 wrote to memory of 3024	2176	Unicorn-18122.exe	45
PID 2176 wrote to memory of 3024	2176	Unicorn-18122.exe	45
PID 2176 wrote to memory of 3024	2176	Unicorn-18122.exe	45
PID 2176 wrote to memory of 3024	2176	Unicorn-18122.exe	45
PID 2328 wrote to memory of 2932	2328	Unicorn-36885.exe	43
PID 2328 wrote to memory of 2932	2328	Unicorn-36885.exe	43
PID 2328 wrote to memory of 2932	2328	Unicorn-36885.exe	43
PID 2328 wrote to memory of 2932	2328	Unicorn-36885.exe	43
PID 2036 wrote to memory of 2120	2036	Unicorn-63343.exe	46
PID 2036 wrote to memory of 2120	2036	Unicorn-63343.exe	46
PID 2036 wrote to memory of 2120	2036	Unicorn-63343.exe	46
PID 2036 wrote to memory of 2120	2036	Unicorn-63343.exe	46

C:\Users\Admin\AppData\Local\Temp\3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe
"C:\Users\Admin\AppData\Local\Temp\3f3f94bac07c3f27197abc4fbe2ff8111b93843d6adcad83b45411e443d382adN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17900.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        8⤵
        Executes dropped EXE
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
        9⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        9⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        9⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        9⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
        9⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14474.exe
        8⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        8⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        8⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
        8⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
        7⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        8⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
        7⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        7⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        8⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        8⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        8⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        8⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        7⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        6⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        7⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
        7⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28009.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        6⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57455.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2787.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40929.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
        7⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5736.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27255.exe
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        6⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46873.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        6⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46964.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        6⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4167.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        6⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
        5⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
        6⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38412.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13236.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17461.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40183.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
        7⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4413.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17566.exe
        7⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        7⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        7⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        6⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        5⤵
        
        PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55149.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        6⤵
        
        PID:356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35548.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17566.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        5⤵
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        5⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        5⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38439.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20971.exe
        5⤵
        
        PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
      4⤵
      PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57455.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
      4⤵
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50489.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
        8⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33073.exe
        8⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4167.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15185.exe
        6⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
        7⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37178.exe
        7⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5948.exe
        6⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        6⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-172.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27464.exe
        5⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54948.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26897.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        6⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        5⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61454.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        5⤵
        
        PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30975.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18087.exe
        5⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        5⤵
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
      4⤵
      PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
      4⤵
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26294.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50764.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
        6⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17408.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18181.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        6⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        5⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33093.exe
        6⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        5⤵
        
        PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-223.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
      4⤵
      PID:5396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54568.exe
        6⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
        7⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17566.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
      4⤵
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3162.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        5⤵
        
        PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
      4⤵
      PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61501.exe
      4⤵
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57749.exe
        5⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60904.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        5⤵
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
      4⤵
      PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
      4⤵
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
      4⤵
      PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
    3⤵
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exe
      4⤵
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21549.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25663.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
      4⤵
      PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50775.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        5⤵
        
        PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
      4⤵
      PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43646.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
      4⤵
      PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8918.exe
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25483.exe
    3⤵
    PID:3388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19157.exe
    3⤵
    PID:3832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
    3⤵
    PID:5456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46156.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        8⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        8⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
        7⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46234.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        7⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26861.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        7⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20063.exe
        7⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
        6⤵
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37568.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63571.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        7⤵
        
        PID:5724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 236
        6⤵
        Program crash
        
        PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
        5⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        6⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        6⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37568.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe
        5⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18711.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        6⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        7⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        7⤵
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        7⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        6⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43646.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        5⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36027.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42492.exe
        6⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34893.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        5⤵
        
        PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40380.exe
      4⤵
      PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
      4⤵
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
      4⤵
      PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20038.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        6⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52311.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        6⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21598.exe
        5⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43433.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28920.exe
      4⤵
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17480.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51408.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        5⤵
        
        PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28009.exe
      4⤵
      PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64124.exe
      4⤵
      PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44359.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49825.exe
        5⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58107.exe
        5⤵
        
        PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
      4⤵
      PID:808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-83.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-83.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54158.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
      4⤵
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
      4⤵
      PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35548.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
      4⤵
      PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3645.exe
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exe
    3⤵
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
    3⤵
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63657.exe
    3⤵
    PID:4384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31857.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31857.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40183.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46919.exe
        6⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        6⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
        6⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        5⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1646.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        5⤵
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46767.exe
      4⤵
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61454.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41500.exe
      4⤵
      PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
      4⤵
      PID:5304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14199.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        5⤵
        
        PID:300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41517.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20063.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
      4⤵
      PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31393.exe
      4⤵
      PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
      4⤵
      PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
      4⤵
      PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47552.exe
      4⤵
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
      4⤵
      PID:1840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17821.exe
    3⤵
    PID:1096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52789.exe
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
    3⤵
    PID:5788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20469.exe
        5⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52145.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
        5⤵
        
        PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
      4⤵
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4983.exe
        5⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        5⤵
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
      4⤵
      PID:5988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21508.exe
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15598.exe
      4⤵
      PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
    3⤵
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
      4⤵
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28009.exe
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
    3⤵
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
    3⤵
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
    3⤵
    PID:5812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31252.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31252.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
      4⤵
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
      4⤵
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65429.exe
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
    3⤵
    PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
    3⤵
    PID:5952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
    3⤵
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
    3⤵
    PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
    3⤵
    PID:5616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
  2⤵
  PID:796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
  2⤵
  PID:3516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
  2⤵
  PID:4300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55227.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55227.exe
  2⤵
  PID:4640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
  2⤵
  PID:5144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe

Filesize
468KB

MD5
c41b75b89eaa2c3c84a916d5b9d12faf

SHA1
883952f92be86acb98f74cc9ac888d2c6729371a

SHA256
6d62e04de95e8d65a883d67037604f4b6af5c1f9a2608883ae1f38751b64dab5

SHA512
db2cf28ab866c06ad9d6b860db8c017070bf0023afbdb4dc6b66d53fa73215ae6ede747d712fc66f31ac4ef301420aff50e59ba2fac8a8c0d7998c2bf3bfc058

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe

Filesize
468KB

MD5
6af3e779d202be57283e1a7490c8c272

SHA1
e044881c99c36950094eaeddf5f239c25c2337dd

SHA256
78b661934c37df6e0f5cb1d12ab5411cc808c4c5d81a1e9e34f9995d99864061

SHA512
f4060d72a04e0e5a1cba42038d18e72a7f39844cda387932247b0e24e1c92bdffebf9055f4e3977060d0d392be8130ba629d16dd332d34c76f2f1684ab9f4170

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31857.exe

Filesize
468KB

MD5
d289dab2199759dc084547924c4ad197

SHA1
8b6143c0a7593a3a3aa19fc030b5b010c60514ae

SHA256
7758f1630e21e1833f20ae349b96f974ede44c8b881debb67d0b9448b15d60ae

SHA512
35e50bffe69b83e0bd9cbdefdcd7b85c6a5f45c3425f626072a278e23e50f6c0f87844ac15e87ed30990f8438f0617ed3ff864201b8738816a8412109c2dbe95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46767.exe

Filesize
468KB

MD5
135517774552fd53531575d77dc260f1

SHA1
bd33201cf5c8183c2997bc2d3682ef89e735c313

SHA256
5606e015d22df3a5745e92c487a0815d21b3bcf65e2f5bbe1c03263324456a15

SHA512
d8d4026eacc032cde0a65df7065d180e014126a3e1c69e0e9faafe7c85c879ab062a6d7e6d15cd576ad9bb433b3f09a5f7c2370bcb6e776cf0cbb92deaff953c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe

Filesize
468KB

MD5
37682e24e83147b1ad4a2ee16158e83f

SHA1
b8fb87f6464ebb0e85a89d50f04cd4c57552e3ff

SHA256
dad898dc88da3678272931975833516dad79aa661946e0543b3fc7bac6cb71ca

SHA512
ca74b870cc894570f3c690928eae5d380329434255e83f1b54daeddc82f82b094f3a51854890108f7da9896898d2f8e6082f98ce1d5642261ed6ec339383846f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe

Filesize
468KB

MD5
69694301efa81afce0edc1add591aa13

SHA1
f0634ce8e6842bd6ff893f43d369dbf59c910750

SHA256
dcd6fef2e02c239e695d4605327563dad4bf59fb7aa10cae14d161e9e46a4afd

SHA512
fe766dcdbacfeda5a10facfc4ae0cddbd22f66b926b1ee269d546ea1c6fab61ab92d823aebea5ceae1fcd42b7d3d5a5d3bf24cb3e7be818f55a7c30fb9cc763b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe

Filesize
468KB

MD5
4ea05ffbc8cd5a367e7049ebdca2989d

SHA1
9c79238e39e027bd41fbe24bbe7f81611a5098a7

SHA256
945970f0e3125b3cc95a52d59fb8de766a99368e16bb72de3f9e96b0dc1ce124

SHA512
077b6be74db891c4969890b72e0e1eb21d4c1352925bb2d4497a8a55715a70a5910476da699af3c33d9d3e4559c410b4a06c1f9c4de2963a1280822e92e676f9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26294.exe

Filesize
468KB

MD5
26048b0abc7c4797e45ff40ddd27a65d

SHA1
825836cc766503e7b8c31cec5c870ee47e968018

SHA256
b3af6b06a81041d3f9dbff9cc4598aeea7cd6c94e9c65cfc3df3ebaaaf082f63

SHA512
2ed9b7c3e6f241e970157127b1392b030b4705192399fb7c5253e975a16086de8db11d7ca42ca27ce3a6c3330c5c37453776388c5dc6ba99bcbf6f2c585609b4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe

Filesize
468KB

MD5
d0cc2fd28b167577cd7622556be29bf9

SHA1
a3dd21606946728aa3b70af3a987e30f355bc970

SHA256
f655029875ed44de5f34a2bb929fb348bcb2d2d7471990b95de61e111f65dbee

SHA512
7c693e4c4ee4a7d69bd6813585b95ebec3b3e0c9ac1c2a2eaf371e4f5ab7c2d9636a460562bb1e077e7122bc588d98f146a228efb7189ce0f282eb7c3476f200

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe

Filesize
468KB

MD5
1ac53bbd281d39967067fd018abb36d3

SHA1
97f70d6c2eb9da80860ad75a415c51264d51ce25

SHA256
3cb7f0067954db8abd4c221936f2033b1c77d3458b5146ff152707be7322eb12

SHA512
ca40929cf38f67b463d91f23f56304f71daa370d3fc9c4fbf951fa08bcd50bb6a4302b368e90affa32906e949c93a0bc33171d1adfc6b6dcedf90b7089314b5a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe

Filesize
468KB

MD5
c033f4c156edc24694778dbb5f511bff

SHA1
2aa1e9f5c513aa77a79633c4b7e79065f2e7954f

SHA256
8df5f55a32fcd037869e3a4285868cd4593b35fb7eb72fc15f985211e49c03c9

SHA512
d5e8dbe2839d96dc0e13f49c8634c10f6d3e9ed48d5bf2a30173a8a9db7eedc0f906d9b11de043317c6040b3f8242d2bcf61d862ffbebf64b34d2b1e4b7e16f5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe

Filesize
468KB

MD5
875e6a822d3574c19037bcb965890a47

SHA1
410852ef28369491c9fe1cd095f83a8504fe59be

SHA256
2f16e1b1fa289e3bb412914cccf93dfddfc8f0d3d34959630f8c8bf85b5a1d79

SHA512
d34d7c93e3b37a8324842f8962959e5606d54fc3cc1761d8a940213e38eabae053a0f963dc62af5ea71641a095d8ae95b0f611adc2178e03b66994a39a6c1fd0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46156.exe

Filesize
468KB

MD5
adc7ffbf7899fea4276943e65f18aca6

SHA1
9379ff9c08eec74fd77263dcee16ac726c9a59fb

SHA256
4adfa15449d0727e913da85e7c3575a1d591243e155b315a3342bab3bb693301

SHA512
619271f78f12da6c4fade864279dc6f5eb4563f058f930fea1ca1aaa382dce522390d339406c77f6488120c8ed967795084e9f4c75988830d4c3aced238d2efd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe

Filesize
468KB

MD5
d594f827ca166f9cdc8baad4b9fd3645

SHA1
9deacacde9f1cc15981a0bf1062bc96648a1131a

SHA256
4db7f65ddbe364e8cc966fc72f920abe29769af452b261c2b302d1866b6cb2a1

SHA512
37e37637018d6a9b8fcdda0f673328cec3eeca65f13abd26b420d7f5d846cf927cafd0b2cb6d6e78a4dc37e708acbd7e13599cc58700554736066e3c20fd34df

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe

Filesize
468KB

MD5
3cd3207502127cdebbd6d78518ccac6b

SHA1
8ca608bf819808494a5722d2588f6f630d06629b

SHA256
38582ec2c2ce47e78e49ddc4cea40c59108f3e9e77ddf71badd4874c8f360c45

SHA512
71af625f356f1aea482f57a323cfb338ff3e62f62483ecd9f6ae90a9177a114e81d990f888e3929f1c36f98ee20c1e29a0c3e02436ef132832d2d40adbc14fd1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe

Filesize
468KB

MD5
9634dbd5b8437eebfa8c1fb2dbceb787

SHA1
d821c57bae7bf6afc8ebf86b21a9dcfce1254f50

SHA256
81d8f049e600a11d3c8a869dc7346e4ecd460db90b474f24634414d45c0c4e11

SHA512
3cf37678a11da9e7b5332054b979e146c6e1ea55628b5e7cbb13ae0f61583f9b0afe817d3ebc2a07dd566d9f4b5371c161fcc96b9dd1bb89e014754ca5f754e6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe

Filesize
468KB

MD5
f11138aa5b4093b240867f14e2e24adc

SHA1
9d9aae0992693bcd95a389537d01f73f3e00ae2d

SHA256
1c147fd60b637352ded3005b1ab30446119a9c75fbce3452574416b62b013cfa

SHA512
18d4549c6b98be8f6c7c0bf923ecbe609dff88d2840a1def863a2202f081c102fafc3a5cfd9a25ff2985b64f5d6fa90379395d968ccb5c578d276968799ebf46

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe

Filesize
468KB

MD5
c79dbcadf8078ca0b00ad762847d8cc3

SHA1
c27077e8979c88238598a8d44e8575b787b19a7e

SHA256
52a576ac4786f464d327e520ae626fcd0a9836145cce23a957b5a56777cc8480

SHA512
22c19240719dbe8af46763bfc7be4f5d8ff3006acf335bdeda5738e0c968611e541a5537e6b795f6869b28486b2484acafe6c6ae793b43d5e3a462b69f3bee21

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe

Filesize
468KB

MD5
87d3eb605783ead31fcdf6f913ea6f0e

SHA1
44310487dae2c2eb4ab6e3bcecf88449f8e7c093

SHA256
cd2d78cbde3e7444e2a7cf9d96e138ea4a328cb63e652688cba9fca9ff6f36a4

SHA512
6ad9d5b87f0705f4857a5b7df23add84b20940438201fcd23f9734340373585e6806a51345f9f9f93cd52fb7e67a9cdaf27a24db2663d119b301c887462bea3d

Download Submit