8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddee

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
Size

468KB
MD5

0b2e27e944f7411310bd663a8e9d5370
SHA1

d41bbcec86c1eb3e026ab0cf610160ed86a4db3b
SHA256

8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddee
SHA512

162b3bb57f998335816b9d186202266f94fab52ffa70c2b06e0ee9d93d5b26f90ad52d1c2e0c344260cd16e5e68ade47c3049135323f71352179eb57e36edbf9
SSDEEP

3072:4belogxaIU57tbYZPzcfmbfD/n2DnsIH/QmyeQVqAV5Kk7Q3uYulj:4b4oCc7tCP4fmbfra1wV5D03uY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2080	Unicorn-18328.exe
3020	Unicorn-23049.exe
2524	Unicorn-38831.exe
3012	Unicorn-18362.exe
2288	Unicorn-22537.exe
3000	Unicorn-28668.exe
2872	Unicorn-8802.exe
1092	Unicorn-24174.exe
1408	Unicorn-19824.exe
2100	Unicorn-38564.exe
1864	Unicorn-7737.exe
2456	Unicorn-13867.exe
1244	Unicorn-20644.exe
1928	Unicorn-42901.exe
2788	Unicorn-22311.exe
2316	Unicorn-47370.exe
2208	Unicorn-26203.exe
2460	Unicorn-33001.exe
2888	Unicorn-43862.exe
2248	Unicorn-55294.exe
1232	Unicorn-55559.exe
296	Unicorn-27525.exe
2124	Unicorn-20749.exe
808	Unicorn-3458.exe
840	Unicorn-12388.exe
944	Unicorn-24732.exe
780	Unicorn-47583.exe
1196	Unicorn-59735.exe
1720	Unicorn-28424.exe
1220	Unicorn-22948.exe
1620	Unicorn-57012.exe
1508	Unicorn-46798.exe
2616	Unicorn-16748.exe
2092	Unicorn-27608.exe
2564	Unicorn-4495.exe
2336	Unicorn-13218.exe
2856	Unicorn-20640.exe
3040	Unicorn-20539.exe
2540	Unicorn-26405.exe
2800	Unicorn-18502.exe
2752	Unicorn-14417.exe
2708	Unicorn-60089.exe
668	Unicorn-60110.exe
3004	Unicorn-60110.exe
1608	Unicorn-2833.exe
1668	Unicorn-18315.exe
1776	Unicorn-32506.exe
1856	Unicorn-57972.exe
1884	Unicorn-56581.exe
1632	Unicorn-10909.exe
2684	Unicorn-31884.exe
1376	Unicorn-57780.exe
2988	Unicorn-56389.exe
2284	Unicorn-14801.exe
2176	Unicorn-25419.exe
2276	Unicorn-9155.exe
2292	Unicorn-38298.exe
948	Unicorn-62248.exe
320	Unicorn-64962.exe
1300	Unicorn-26068.exe
796	Unicorn-19937.exe
1656	Unicorn-47235.exe
1924	Unicorn-62559.exe
1400	Unicorn-42404.exe

Loads dropped DLL 64 IoCs

pid	Process
2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
2080	Unicorn-18328.exe
2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
2080	Unicorn-18328.exe
3020	Unicorn-23049.exe
3020	Unicorn-23049.exe
2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
2524	Unicorn-38831.exe
2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
2524	Unicorn-38831.exe
2080	Unicorn-18328.exe
2080	Unicorn-18328.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2288	Unicorn-22537.exe
2288	Unicorn-22537.exe
2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
2872	Unicorn-8802.exe
2872	Unicorn-8802.exe
3012	Unicorn-18362.exe
2080	Unicorn-18328.exe
3012	Unicorn-18362.exe
2080	Unicorn-18328.exe
3020	Unicorn-23049.exe
3020	Unicorn-23049.exe
2524	Unicorn-38831.exe
2524	Unicorn-38831.exe
1092	Unicorn-24174.exe
1092	Unicorn-24174.exe
2288	Unicorn-22537.exe
2288	Unicorn-22537.exe
2100	Unicorn-38564.exe
2100	Unicorn-38564.exe
1864	Unicorn-7737.exe
2872	Unicorn-8802.exe
2872	Unicorn-8802.exe
1864	Unicorn-7737.exe
2080	Unicorn-18328.exe
2080	Unicorn-18328.exe
2456	Unicorn-13867.exe
2456	Unicorn-13867.exe
3012	Unicorn-18362.exe
3012	Unicorn-18362.exe
1408	Unicorn-19824.exe
1408	Unicorn-19824.exe
2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
1244	Unicorn-20644.exe
1244	Unicorn-20644.exe
3020	Unicorn-23049.exe
3020	Unicorn-23049.exe
1928	Unicorn-42901.exe
1928	Unicorn-42901.exe
2524	Unicorn-38831.exe
2524	Unicorn-38831.exe
2788	Unicorn-22311.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2712	3000	WerFault.exe	36
3140	3192	WerFault.exe	248

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11983.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
2080	Unicorn-18328.exe
3020	Unicorn-23049.exe
2524	Unicorn-38831.exe
3012	Unicorn-18362.exe
2288	Unicorn-22537.exe
3000	Unicorn-28668.exe
2872	Unicorn-8802.exe
1092	Unicorn-24174.exe
1408	Unicorn-19824.exe
2100	Unicorn-38564.exe
1864	Unicorn-7737.exe
2456	Unicorn-13867.exe
1244	Unicorn-20644.exe
1928	Unicorn-42901.exe
2788	Unicorn-22311.exe
2316	Unicorn-47370.exe
2208	Unicorn-26203.exe
2460	Unicorn-33001.exe
2888	Unicorn-43862.exe
2248	Unicorn-55294.exe
1232	Unicorn-55559.exe
2124	Unicorn-20749.exe
296	Unicorn-27525.exe
840	Unicorn-12388.exe
944	Unicorn-24732.exe
808	Unicorn-3458.exe
780	Unicorn-47583.exe
1196	Unicorn-59735.exe
1720	Unicorn-28424.exe
1220	Unicorn-22948.exe
1508	Unicorn-46798.exe
1620	Unicorn-57012.exe
2616	Unicorn-16748.exe
2092	Unicorn-27608.exe
2564	Unicorn-4495.exe
2336	Unicorn-13218.exe
2856	Unicorn-20640.exe
3040	Unicorn-20539.exe
2540	Unicorn-26405.exe
2752	Unicorn-14417.exe
2800	Unicorn-18502.exe
2708	Unicorn-60089.exe
668	Unicorn-60110.exe
3004	Unicorn-60110.exe
1608	Unicorn-2833.exe
1776	Unicorn-32506.exe
1668	Unicorn-18315.exe
1856	Unicorn-57972.exe
1884	Unicorn-56581.exe
1632	Unicorn-10909.exe
2684	Unicorn-31884.exe
1376	Unicorn-57780.exe
2284	Unicorn-14801.exe
2988	Unicorn-56389.exe
2176	Unicorn-25419.exe
2276	Unicorn-9155.exe
2292	Unicorn-38298.exe
948	Unicorn-62248.exe
796	Unicorn-19937.exe
1300	Unicorn-26068.exe
320	Unicorn-64962.exe
1656	Unicorn-47235.exe
1924	Unicorn-62559.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2080	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	30
PID 2632 wrote to memory of 2080	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	30
PID 2632 wrote to memory of 2080	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	30
PID 2632 wrote to memory of 2080	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	30
PID 2632 wrote to memory of 3020	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	33
PID 2632 wrote to memory of 3020	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	33
PID 2632 wrote to memory of 3020	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	33
PID 2632 wrote to memory of 3020	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	33
PID 2080 wrote to memory of 2524	2080	Unicorn-18328.exe	32
PID 2080 wrote to memory of 2524	2080	Unicorn-18328.exe	32
PID 2080 wrote to memory of 2524	2080	Unicorn-18328.exe	32
PID 2080 wrote to memory of 2524	2080	Unicorn-18328.exe	32
PID 3020 wrote to memory of 3012	3020	Unicorn-23049.exe	34
PID 3020 wrote to memory of 3012	3020	Unicorn-23049.exe	34
PID 3020 wrote to memory of 3012	3020	Unicorn-23049.exe	34
PID 3020 wrote to memory of 3012	3020	Unicorn-23049.exe	34
PID 2632 wrote to memory of 2288	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	35
PID 2632 wrote to memory of 2288	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	35
PID 2632 wrote to memory of 2288	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	35
PID 2632 wrote to memory of 2288	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	35
PID 2524 wrote to memory of 3000	2524	Unicorn-38831.exe	36
PID 2524 wrote to memory of 3000	2524	Unicorn-38831.exe	36
PID 2524 wrote to memory of 3000	2524	Unicorn-38831.exe	36
PID 2524 wrote to memory of 3000	2524	Unicorn-38831.exe	36
PID 2080 wrote to memory of 2872	2080	Unicorn-18328.exe	37
PID 2080 wrote to memory of 2872	2080	Unicorn-18328.exe	37
PID 2080 wrote to memory of 2872	2080	Unicorn-18328.exe	37
PID 2080 wrote to memory of 2872	2080	Unicorn-18328.exe	37
PID 3000 wrote to memory of 2712	3000	Unicorn-28668.exe	38
PID 3000 wrote to memory of 2712	3000	Unicorn-28668.exe	38
PID 3000 wrote to memory of 2712	3000	Unicorn-28668.exe	38
PID 3000 wrote to memory of 2712	3000	Unicorn-28668.exe	38
PID 2288 wrote to memory of 1092	2288	Unicorn-22537.exe	39
PID 2288 wrote to memory of 1092	2288	Unicorn-22537.exe	39
PID 2288 wrote to memory of 1092	2288	Unicorn-22537.exe	39
PID 2288 wrote to memory of 1092	2288	Unicorn-22537.exe	39
PID 2632 wrote to memory of 1408	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	40
PID 2632 wrote to memory of 1408	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	40
PID 2632 wrote to memory of 1408	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	40
PID 2632 wrote to memory of 1408	2632	8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe	40
PID 2872 wrote to memory of 2100	2872	Unicorn-8802.exe	41
PID 2872 wrote to memory of 2100	2872	Unicorn-8802.exe	41
PID 2872 wrote to memory of 2100	2872	Unicorn-8802.exe	41
PID 2872 wrote to memory of 2100	2872	Unicorn-8802.exe	41
PID 3012 wrote to memory of 2456	3012	Unicorn-18362.exe	42
PID 3012 wrote to memory of 2456	3012	Unicorn-18362.exe	42
PID 3012 wrote to memory of 2456	3012	Unicorn-18362.exe	42
PID 3012 wrote to memory of 2456	3012	Unicorn-18362.exe	42
PID 2080 wrote to memory of 1864	2080	Unicorn-18328.exe	43
PID 2080 wrote to memory of 1864	2080	Unicorn-18328.exe	43
PID 2080 wrote to memory of 1864	2080	Unicorn-18328.exe	43
PID 2080 wrote to memory of 1864	2080	Unicorn-18328.exe	43
PID 3020 wrote to memory of 1244	3020	Unicorn-23049.exe	44
PID 3020 wrote to memory of 1244	3020	Unicorn-23049.exe	44
PID 3020 wrote to memory of 1244	3020	Unicorn-23049.exe	44
PID 3020 wrote to memory of 1244	3020	Unicorn-23049.exe	44
PID 2524 wrote to memory of 1928	2524	Unicorn-38831.exe	45
PID 2524 wrote to memory of 1928	2524	Unicorn-38831.exe	45
PID 2524 wrote to memory of 1928	2524	Unicorn-38831.exe	45
PID 2524 wrote to memory of 1928	2524	Unicorn-38831.exe	45
PID 1092 wrote to memory of 2788	1092	Unicorn-24174.exe	46
PID 1092 wrote to memory of 2788	1092	Unicorn-24174.exe	46
PID 1092 wrote to memory of 2788	1092	Unicorn-24174.exe	46
PID 1092 wrote to memory of 2788	1092	Unicorn-24174.exe	46

C:\Users\Admin\AppData\Local\Temp\8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe
"C:\Users\Admin\AppData\Local\Temp\8b3afdfcca4c74d4c55e58203a54bea5fb506f0bf276363a0068aa3429d6ddeeN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 200
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
        7⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
        8⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        8⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
        8⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        8⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        7⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        7⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        6⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        7⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61153.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe
        6⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56743.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45855.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        5⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38933.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        6⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        6⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        7⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        7⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22616.exe
        6⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe
        5⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2373.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28810.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60771.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39671.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
        5⤵
        
        PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
        5⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61481.exe
      4⤵
      PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38564.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21792.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        8⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        9⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        8⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65512.exe
        7⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        7⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47920.exe
        6⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        7⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25960.exe
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        7⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        7⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50851.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        6⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27608.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        6⤵
        Executes dropped EXE
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        7⤵
        
        PID:276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
        6⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29006.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        7⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        5⤵
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
        6⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        6⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        5⤵
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57354.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45006.exe
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        6⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        7⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        7⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56405.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20215.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        5⤵
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        6⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        6⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14941.exe
        5⤵
        
        PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
      4⤵
      PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        5⤵
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42667.exe
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60771.exe
      4⤵
      PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
      4⤵
      PID:6568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        6⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
        7⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        7⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        6⤵
        
        PID:656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
        6⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        5⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47448.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        6⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        5⤵
        
        PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13218.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        6⤵
        
        PID:608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        6⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41199.exe
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41300.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
      4⤵
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
        5⤵
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50130.exe
        5⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
      4⤵
      PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40345.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45006.exe
      4⤵
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55294.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        5⤵
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        5⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7183.exe
      4⤵
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        5⤵
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35575.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47111.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47137.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
      4⤵
      PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
      4⤵
      PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
      4⤵
      PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11440.exe
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10792.exe
    3⤵
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
    3⤵
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
    3⤵
    PID:5492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
    3⤵
    PID:6620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13867.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        7⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        8⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        8⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        8⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55750.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46042.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10087.exe
        7⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27245.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        7⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30669.exe
        6⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
        6⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        6⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        7⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41605.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1702.exe
        5⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24475.exe
        5⤵
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        7⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
        8⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        8⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        8⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        8⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        7⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        7⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39689.exe
        6⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34885.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22531.exe
        6⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11547.exe
        5⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47682.exe
        6⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43262.exe
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61807.exe
        6⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        5⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        5⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51698.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19435.exe
      4⤵
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        5⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50349.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
      4⤵
      PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42667.exe
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47796.exe
      4⤵
      PID:6500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20644.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10909.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47111.exe
        6⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        7⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35408.exe
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        6⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        5⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        6⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 188
        7⤵
        Program crash
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49965.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        5⤵
        
        PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        5⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31884.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        5⤵
        
        PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
      4⤵
      PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34418.exe
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38851.exe
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19841.exe
        5⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11152.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
      4⤵
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
      4⤵
      PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45006.exe
      4⤵
      PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23593.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
      4⤵
      PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
      4⤵
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
      4⤵
      PID:936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
    3⤵
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25762.exe
      4⤵
      PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
      4⤵
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
      4⤵
      PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11939.exe
    3⤵
    PID:4260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
    3⤵
    PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43871.exe
    3⤵
    PID:6352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22537.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22537.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22311.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28424.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        7⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        8⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        8⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        8⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
        7⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        7⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27245.exe
        6⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        7⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33058.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2458.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2383.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11152.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        6⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        5⤵
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40458.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22948.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30147.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        6⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        5⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        6⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        5⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52659.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe
        5⤵
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44062.exe
        5⤵
        
        PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe
      4⤵
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
      4⤵
      PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17883.exe
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7915.exe
      4⤵
      PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1870.exe
        7⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5948.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        5⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13457.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        6⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25148.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49090.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38023.exe
      4⤵
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17372.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
      4⤵
      PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe
        5⤵
        
        PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exe
      4⤵
      PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
      4⤵
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
      4⤵
      PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
      4⤵
      PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62559.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32081.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39708.exe
      4⤵
      PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57341.exe
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10910.exe
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2813.exe
    3⤵
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
    3⤵
    PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
    3⤵
    PID:6596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        5⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
        5⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        5⤵
        
        PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        5⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59396.exe
      4⤵
      PID:6176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
      4⤵
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
      4⤵
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
      4⤵
      PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
    3⤵
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
      4⤵
      PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32081.exe
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22494.exe
    3⤵
    PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
    3⤵
    PID:6256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3458.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3458.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29274.exe
      4⤵
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17750.exe
      4⤵
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
      4⤵
      PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27245.exe
    3⤵
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
      4⤵
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50130.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
      4⤵
      PID:6708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
    3⤵
    PID:3780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
    3⤵
    PID:4740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
    3⤵
    PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
    3⤵
    PID:6600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32506.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32506.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38175.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30147.exe
      4⤵
      PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
      4⤵
      PID:6504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
    3⤵
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33996.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
    3⤵
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41605.exe
    3⤵
    PID:4188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
    3⤵
    PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
  2⤵
  PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10733.exe
    3⤵
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
    3⤵
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
    3⤵
    PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
    3⤵
    PID:6764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
  2⤵
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
  2⤵
  PID:3360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
  2⤵
  PID:3356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8766.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8766.exe
  2⤵
  PID:5396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
  2⤵
  PID:6424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe

Filesize
468KB

MD5
d89c3e9ebba934d88de2a217651cf61c

SHA1
06fbb199272dfffd3191a55bb0976045ecedef94

SHA256
e55855da30240153bfb87bcf30e324f9c1ba43dd5e1f7a88afadb4c3bc423772

SHA512
f4f82f9d4d0b8b0b308234e1be4b366908c30ab7cdb59358d70701a0c025e932264e4088b99a46692c4b5b3a33d07e23a813b0d84c8b494f45b7af0c071033f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe

Filesize
468KB

MD5
46a44ebc228c34cbd1b081e9e5ced0d7

SHA1
5bff1b94f5d767f6309932a9d641b623dfb67381

SHA256
93b94a5c147efb08706d43dca69724b21c2c95887a1428b8f57363c68a7ea4d4

SHA512
e7f9ad7f5aa8978abb56b30b28501e5aa186c3b102dc36a0c36286886047408b4ad95106b8f1d62c9c0d07d317c546473a6ae54bf75af35824cd7583ecaeeb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe

Filesize
468KB

MD5
364d0b9b4446e631c7ac64448135f951

SHA1
f9324edded0848c6d948ea394a72250b10005fce

SHA256
65883951f86b748be5bec577fbccb3a3f9e63215cfc24f66f90a05ca98692337

SHA512
9da0ceac390c9af46b7a402297142ebbee407b0254aae6eb9abbd8fd98928c7e6130e3f2d58c2fef1dd88469420544d0b4915a2f4215f546e1099104ad5e503d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38564.exe

Filesize
468KB

MD5
f8b786e182e2a01f0c4129d0347344bf

SHA1
b4ec234a2984c463ca11b74da0879bc2332bb1e8

SHA256
b3460770c4408ca580fdce2ef18fc8faeb65dcb7080771244ef17d677a3179a8

SHA512
a8dafc3e9b8aa3602ffebf708e6860370827231ff80518faa26f5b6c5ae64a6163b1aebc1dff7e01471338e4c126ca691da9217e9c6081075d8d9415b4299cb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe

Filesize
468KB

MD5
ca966fb0ca27cd86bc00c910bfcbc849

SHA1
172700a4f4a483f3b5e6d4ed637e576dcc93478c

SHA256
97d15456e03c3c62a26ed9dcf4453be136ce52c49c118fdf5a6fa89a55bdd5ca

SHA512
7cfd8da66d3c03ef077b987026b9eeb2d77854766c6bb67668516c3aeddaf38bd632286ed5a953c4dbbadc208e6be9875895fbb4beaaf60cdfecaff751c83f91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe

Filesize
468KB

MD5
368562675cb32f6665ae49afc961d494

SHA1
799e09a8c0703f731f7f13ccfea7f8b015a6d676

SHA256
144ea16ada300f88dd37cd03d75ba77d5eef521a0a6fe756017ada5a58e89fad

SHA512
104e9ac8d10baaffb6061e7f7367049bb65dab9c79901c545f8699a800a11f33f4dde3cc791066c3a7c3bf364a718cf92a0c3d37cefe12e71627e16953ef8079

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13867.exe

Filesize
468KB

MD5
be67e3b765cf434a859925d99d6c1bcf

SHA1
a980a3268b86c8af20b8fd4613316d1d1566d5f1

SHA256
2a9edfe728571510f57afc62c26ccfb5ea255cd32586683caea6a7b0dbcd67cd

SHA512
8e987ffee93ab3eac7a28dfc448bdd07a598fd7d0e53451e8414e31586ad0b4f66b0fc1e7270035b21a6070b67fcc58f7eed55fdb96edc341192e8713ca6e9e4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe

Filesize
468KB

MD5
d8637ab98be3062f48b4baa8bc629e0c

SHA1
8bd9cbf29a5e2fcc12265e68a8d566f5442125f9

SHA256
b048f8457bba84dde0063d68af1e414f88795042ce23bc906364ac0b4dfa5045

SHA512
a3c08181783a33809916c6f979b265527917a968284823b805eaf445f87a517a2c5254ca3926a7c576a844fe50f2cb1f77581854de6b00510e6100d49463ac48

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe

Filesize
468KB

MD5
77fbf854a79048e5463885b272b1be31

SHA1
2906013726660eb22f047374ba3bf2a6bee35e0f

SHA256
f8f57e1aa8b6789031033387e98d64a666d4079b17360b6b80ffa23b176a9383

SHA512
6d30d58796d1416e49ae3fc9263c5a6d44e1fca8c648f6b69d7ccd643fa9203c4e2c13d687e65ba36047eeaf9e6437466db9b1f1e25bcf9ca38d79dfd9b191ad

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20644.exe

Filesize
468KB

MD5
5ba4ce980ae6d8e4e12cb9e78b019754

SHA1
26627abb919710326f7df22ff5a4dee0a32b9ec2

SHA256
44e5b15b08ebae188783c37ac029e4d35bb8f38f129dd25029b1702781ff8bf2

SHA512
03c3227b82b36d2387e496cb6b474b44dc95a31bb6e396fd04375d8dbdf9064f5a635b18b01a5f7957f40f7cfc6a2296711ef9c44136f6c0d250e2af5de94083

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22311.exe

Filesize
468KB

MD5
c65562972dc74bc68bd5118e96c5f60a

SHA1
ac23947be1445981f1867e1199e8d82ee4e3308d

SHA256
373a84ae1fb0e29a811e7280c834b946676c89cd23d496d67c4eac1a5b6576e5

SHA512
6bbc50a929873d487910d4a0c64b205e2d0610acf6992ad08e6cbb4c2d8135a67c821f07f6435d31dd167ca1872d8f17d3410f8e7d9a92ee7108b077dcf0ed67

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22537.exe

Filesize
468KB

MD5
4b24f22ac65925f253e50e59885754b4

SHA1
7ed7cf41c2a63b7a4bfffbb1eb01916b45caaac8

SHA256
b13a0106585df95cd07dc0aacabf87b1556ef2a7682a723ea9ac6189ef88f2be

SHA512
19ae8ff25941465d5e66c59d01f70994ed094c1ac267da181990c7c129cf3c5ccfeb750b0fcc4a8f673edb4be21cdabfe37bc22118cb1ad82b64c44dab5c8b01

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe

Filesize
468KB

MD5
0d68a4fe13c8ed390e30052e8a1ed73e

SHA1
a56271760904955889f9b00536f98321fb3fa7f6

SHA256
f4f241ea5f72b523c3474b3499c331ac7d15d409578d32b4e21ebaff8d85555a

SHA512
eec10f8a57cffc72af256ea488c8432b0e36bc5ee2f548d3257859a61f9fc91f52136a6b73d78026468bc37a1aa2e29c82f962afe8642b50e21fb14e863730aa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe

Filesize
468KB

MD5
57e747891e32fea4845a712673a48f7c

SHA1
623f7ef47fbbc0e90f9cc2062bb47646311601a4

SHA256
cd9e96ef734f3a5c031dee1474176f93b6d8916648f781edcc7ec23c5b919540

SHA512
57a657fc34a0b5b7a5adfca225932c0033ce3407ea16ea1ddc28fd50fe779edb56befc8a79f69f5427b12f5bd371580524e0d10db5768583eb4cd087bba9f40e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe

Filesize
468KB

MD5
b7aa7bc49ea7cf8fac9110ff5a3ff8c3

SHA1
be27b01b1b672b341fd7be184984412de57cd0d2

SHA256
73a61b5d473ee91fd3bae470e80c5c92caf3b4f5068852b7bb01b96ffdaa1fd9

SHA512
4f2452346a45a81fa39be9564407bbc759d2e7ea573978ebced4182d78a894aea8a2e11496c3c5f98dc4741483b4eae3b206b8dbc95945639ce41db2247962e1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe

Filesize
468KB

MD5
82cda2095a126e0e2e013b14f85b0573

SHA1
1ee5059cc67734134556d40f888db12bdadf611a

SHA256
f66003bf1a85573a5c127cf34f8ab1359898b7d50f999c2c2c65764cc1cd245f

SHA512
4e09c83e6a23525f98ae52f8385c4d9081c9654a5d9bf9f42121a7fe6f47b645fa3e7078fc357eec22c0ed7b37d1b2c8e9481033851cd110d570cf375ecf5ba9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe

Filesize
468KB

MD5
d83a73ae5b20e5a3bef963f7d46b7aa0

SHA1
3f5db0399c5637673b15915a6a1bcb7224225eee

SHA256
a2e927a3a627d4b2f1f1ee53d15efe9c23fe076e5ed9257cd72826a570a13517

SHA512
f95d685d77d78d5e727fa9b7c4aed737ad2037d122d7ebb1e9171e8c2882fb222f192e4742355f6fec7cfa4b652c99d87da59387b59f9b5f38b7f5d1a8c9f107

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe

Filesize
468KB

MD5
36fcaeff6ae0a6b473aa458acd24f47f

SHA1
271db54762fea089a19e335d863ba52792830a59

SHA256
efb8e4656286fc9c6f1cd734149477e022d95adbebc7d2d247db41dac2bbfde1

SHA512
a477071d3d4aec45f13d8275f57d456a3652e432bfb9ca39f6c8d16243336a90f52c65b945c7fc990d55feafff293c49cf3a390ed2eafa217d9226e492737e25

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe

Filesize
468KB

MD5
2b107a1a7d0a36c6c38db7dae7d11fc9

SHA1
6c3259c270aa0d56bb1d645767ce505362a1917e

SHA256
ea65724d55192b5fb3fdea027212813394718839b79cc9c2e2cc145c9e233bc1

SHA512
e797cdef086df1ae4cc3d21dd8634f49b5b0ce400b7b4f21539e03944a9c746ddfb9db0e1626af485a2a17748d6f1ed2b5293c8514d08efe8ac3152e011d79f6

Download Submit