022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
Size

468KB
MD5

01a273de6ff9c911c97cd4bf6cac5520
SHA1

5742ad56b2d71c2c597cfa96242fab060998f1be
SHA256

022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397
SHA512

ef2e4b598240b487affba732e3f00c17a212887674dd0c73a7b2d7d3b3209452890fecbf6536f98f98bba227cb9583de84b158654c9f4a5d79f64e54b13dc8f2
SSDEEP

3072:1GjNogIKIQ5UMbYcHzcOcf8/zCvsMLp+nLH/SVPJc3a8qbSgovl1:1G5oDAUMXH4OcfF1e8c3LISgo

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2488	Unicorn-15671.exe
2080	Unicorn-60076.exe
2084	Unicorn-4331.exe
2264	Unicorn-2681.exe
2716	Unicorn-64134.exe
2808	Unicorn-44269.exe
2708	Unicorn-53728.exe
2604	Unicorn-22547.exe
2576	Unicorn-12140.exe
2392	Unicorn-34607.exe
2092	Unicorn-64539.exe
1800	Unicorn-44674.exe
1504	Unicorn-65286.exe
2340	Unicorn-19349.exe
1308	Unicorn-1223.exe
1780	Unicorn-50787.exe
1812	Unicorn-60299.exe
2448	Unicorn-55660.exe
2672	Unicorn-11612.exe
1128	Unicorn-23216.exe
1084	Unicorn-7699.exe
684	Unicorn-31649.exe
2768	Unicorn-60429.exe
1244	Unicorn-54299.exe
740	Unicorn-1014.exe
896	Unicorn-7144.exe
2544	Unicorn-39625.exe
556	Unicorn-42947.exe
1752	Unicorn-19759.exe
2316	Unicorn-17726.exe
880	Unicorn-18280.exe
688	Unicorn-10769.exe
1584	Unicorn-12807.exe
2540	Unicorn-43634.exe
2288	Unicorn-61816.exe
2484	Unicorn-35274.exe
2064	Unicorn-51610.exe
3044	Unicorn-47889.exe
2832	Unicorn-64225.exe
1512	Unicorn-39166.exe
2840	Unicorn-20399.exe
2612	Unicorn-43058.exe
2616	Unicorn-32150.exe
2748	Unicorn-31885.exe
2572	Unicorn-48849.exe
3020	Unicorn-3177.exe
3016	Unicorn-7816.exe
1940	Unicorn-27682.exe
1696	Unicorn-56462.exe
1508	Unicorn-47532.exe
1704	Unicorn-2985.exe
1152	Unicorn-3540.exe
1432	Unicorn-18552.exe
324	Unicorn-60354.exe
2876	Unicorn-4054.exe
2452	Unicorn-16669.exe
2884	Unicorn-54032.exe
2400	Unicorn-60162.exe
2472	Unicorn-45974.exe
1052	Unicorn-14142.exe
1660	Unicorn-27141.exe
1564	Unicorn-59259.exe
292	Unicorn-14505.exe
972	Unicorn-46815.exe

Loads dropped DLL 64 IoCs

pid	Process
2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
2488	Unicorn-15671.exe
2488	Unicorn-15671.exe
2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
2080	Unicorn-60076.exe
2080	Unicorn-60076.exe
2084	Unicorn-4331.exe
2084	Unicorn-4331.exe
2488	Unicorn-15671.exe
2488	Unicorn-15671.exe
2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
2808	Unicorn-44269.exe
2808	Unicorn-44269.exe
2488	Unicorn-15671.exe
2488	Unicorn-15671.exe
2264	Unicorn-2681.exe
2264	Unicorn-2681.exe
2080	Unicorn-60076.exe
2716	Unicorn-64134.exe
2080	Unicorn-60076.exe
2716	Unicorn-64134.exe
2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
2084	Unicorn-4331.exe
2084	Unicorn-4331.exe
2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
2604	Unicorn-22547.exe
2604	Unicorn-22547.exe
2808	Unicorn-44269.exe
2808	Unicorn-44269.exe
2708	Unicorn-53728.exe
2708	Unicorn-53728.exe
2392	Unicorn-34607.exe
2392	Unicorn-34607.exe
2576	Unicorn-12140.exe
2576	Unicorn-12140.exe
2488	Unicorn-15671.exe
2264	Unicorn-2681.exe
2264	Unicorn-2681.exe
2488	Unicorn-15671.exe
1504	Unicorn-65286.exe
1504	Unicorn-65286.exe
1800	Unicorn-44674.exe
1800	Unicorn-44674.exe
2084	Unicorn-4331.exe
2084	Unicorn-4331.exe
2092	Unicorn-64539.exe
2080	Unicorn-60076.exe
2080	Unicorn-60076.exe
2092	Unicorn-64539.exe
2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
2340	Unicorn-19349.exe
2340	Unicorn-19349.exe
2716	Unicorn-64134.exe
2716	Unicorn-64134.exe
1308	Unicorn-1223.exe
1308	Unicorn-1223.exe
2604	Unicorn-22547.exe
2604	Unicorn-22547.exe
1780	Unicorn-50787.exe
1780	Unicorn-50787.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
5768	5964	WerFault.exe	487
5528	5848	WerFault.exe	478
5600	5880	WerFault.exe	486
5556	5904	WerFault.exe	480
5536	5840	WerFault.exe	485
1708	6028	WerFault.exe	495
5744	5888	WerFault.exe	479

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40354.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
2488	Unicorn-15671.exe
2080	Unicorn-60076.exe
2084	Unicorn-4331.exe
2808	Unicorn-44269.exe
2264	Unicorn-2681.exe
2716	Unicorn-64134.exe
2708	Unicorn-53728.exe
2604	Unicorn-22547.exe
2576	Unicorn-12140.exe
2392	Unicorn-34607.exe
1800	Unicorn-44674.exe
1504	Unicorn-65286.exe
2092	Unicorn-64539.exe
2340	Unicorn-19349.exe
1308	Unicorn-1223.exe
1780	Unicorn-50787.exe
1812	Unicorn-60299.exe
2672	Unicorn-11612.exe
2448	Unicorn-55660.exe
1084	Unicorn-7699.exe
1128	Unicorn-23216.exe
684	Unicorn-31649.exe
1244	Unicorn-54299.exe
2768	Unicorn-60429.exe
740	Unicorn-1014.exe
896	Unicorn-7144.exe
2544	Unicorn-39625.exe
556	Unicorn-42947.exe
1752	Unicorn-19759.exe
2316	Unicorn-17726.exe
880	Unicorn-18280.exe
688	Unicorn-10769.exe
1584	Unicorn-12807.exe
2540	Unicorn-43634.exe
2288	Unicorn-61816.exe
2484	Unicorn-35274.exe
2064	Unicorn-51610.exe
3044	Unicorn-47889.exe
2832	Unicorn-64225.exe
1512	Unicorn-39166.exe
2840	Unicorn-20399.exe
2612	Unicorn-43058.exe
2748	Unicorn-31885.exe
2572	Unicorn-48849.exe
2616	Unicorn-32150.exe
3020	Unicorn-3177.exe
1940	Unicorn-27682.exe
3016	Unicorn-7816.exe
1696	Unicorn-56462.exe
1508	Unicorn-47532.exe
1704	Unicorn-2985.exe
1152	Unicorn-3540.exe
1432	Unicorn-18552.exe
324	Unicorn-60354.exe
2876	Unicorn-4054.exe
2452	Unicorn-16669.exe
2400	Unicorn-60162.exe
2884	Unicorn-54032.exe
2472	Unicorn-45974.exe
1052	Unicorn-14142.exe
1660	Unicorn-27141.exe
1564	Unicorn-59259.exe
292	Unicorn-14505.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2488	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	31
PID 2356 wrote to memory of 2488	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	31
PID 2356 wrote to memory of 2488	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	31
PID 2356 wrote to memory of 2488	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	31
PID 2488 wrote to memory of 2080	2488	Unicorn-15671.exe	32
PID 2488 wrote to memory of 2080	2488	Unicorn-15671.exe	32
PID 2488 wrote to memory of 2080	2488	Unicorn-15671.exe	32
PID 2488 wrote to memory of 2080	2488	Unicorn-15671.exe	32
PID 2356 wrote to memory of 2084	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	33
PID 2356 wrote to memory of 2084	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	33
PID 2356 wrote to memory of 2084	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	33
PID 2356 wrote to memory of 2084	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	33
PID 2080 wrote to memory of 2264	2080	Unicorn-60076.exe	34
PID 2080 wrote to memory of 2264	2080	Unicorn-60076.exe	34
PID 2080 wrote to memory of 2264	2080	Unicorn-60076.exe	34
PID 2080 wrote to memory of 2264	2080	Unicorn-60076.exe	34
PID 2084 wrote to memory of 2716	2084	Unicorn-4331.exe	35
PID 2084 wrote to memory of 2716	2084	Unicorn-4331.exe	35
PID 2084 wrote to memory of 2716	2084	Unicorn-4331.exe	35
PID 2084 wrote to memory of 2716	2084	Unicorn-4331.exe	35
PID 2488 wrote to memory of 2808	2488	Unicorn-15671.exe	36
PID 2488 wrote to memory of 2808	2488	Unicorn-15671.exe	36
PID 2488 wrote to memory of 2808	2488	Unicorn-15671.exe	36
PID 2488 wrote to memory of 2808	2488	Unicorn-15671.exe	36
PID 2356 wrote to memory of 2708	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	37
PID 2356 wrote to memory of 2708	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	37
PID 2356 wrote to memory of 2708	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	37
PID 2356 wrote to memory of 2708	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	37
PID 2808 wrote to memory of 2604	2808	Unicorn-44269.exe	38
PID 2808 wrote to memory of 2604	2808	Unicorn-44269.exe	38
PID 2808 wrote to memory of 2604	2808	Unicorn-44269.exe	38
PID 2808 wrote to memory of 2604	2808	Unicorn-44269.exe	38
PID 2488 wrote to memory of 2576	2488	Unicorn-15671.exe	39
PID 2488 wrote to memory of 2576	2488	Unicorn-15671.exe	39
PID 2488 wrote to memory of 2576	2488	Unicorn-15671.exe	39
PID 2488 wrote to memory of 2576	2488	Unicorn-15671.exe	39
PID 2264 wrote to memory of 2392	2264	Unicorn-2681.exe	40
PID 2264 wrote to memory of 2392	2264	Unicorn-2681.exe	40
PID 2264 wrote to memory of 2392	2264	Unicorn-2681.exe	40
PID 2264 wrote to memory of 2392	2264	Unicorn-2681.exe	40
PID 2080 wrote to memory of 1800	2080	Unicorn-60076.exe	41
PID 2080 wrote to memory of 1800	2080	Unicorn-60076.exe	41
PID 2080 wrote to memory of 1800	2080	Unicorn-60076.exe	41
PID 2080 wrote to memory of 1800	2080	Unicorn-60076.exe	41
PID 2716 wrote to memory of 2092	2716	Unicorn-64134.exe	42
PID 2716 wrote to memory of 2092	2716	Unicorn-64134.exe	42
PID 2716 wrote to memory of 2092	2716	Unicorn-64134.exe	42
PID 2716 wrote to memory of 2092	2716	Unicorn-64134.exe	42
PID 2084 wrote to memory of 1504	2084	Unicorn-4331.exe	44
PID 2084 wrote to memory of 1504	2084	Unicorn-4331.exe	44
PID 2084 wrote to memory of 1504	2084	Unicorn-4331.exe	44
PID 2084 wrote to memory of 1504	2084	Unicorn-4331.exe	44
PID 2356 wrote to memory of 2340	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	43
PID 2356 wrote to memory of 2340	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	43
PID 2356 wrote to memory of 2340	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	43
PID 2356 wrote to memory of 2340	2356	022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe	43
PID 2604 wrote to memory of 1308	2604	Unicorn-22547.exe	45
PID 2604 wrote to memory of 1308	2604	Unicorn-22547.exe	45
PID 2604 wrote to memory of 1308	2604	Unicorn-22547.exe	45
PID 2604 wrote to memory of 1308	2604	Unicorn-22547.exe	45
PID 2808 wrote to memory of 1780	2808	Unicorn-44269.exe	46
PID 2808 wrote to memory of 1780	2808	Unicorn-44269.exe	46
PID 2808 wrote to memory of 1780	2808	Unicorn-44269.exe	46
PID 2808 wrote to memory of 1780	2808	Unicorn-44269.exe	46

C:\Users\Admin\AppData\Local\Temp\022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe
"C:\Users\Admin\AppData\Local\Temp\022ad65261879cbb703b84dfff9bc0fe648557296d4effccf75043bc0b2d4397N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15671.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15671.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55660.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        8⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        9⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        9⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        9⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        9⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24722.exe
        8⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        8⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4009.exe
        8⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61497.exe
        8⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
        7⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
        8⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40696.exe
        8⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36800.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        7⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        8⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
        8⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        6⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44631.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        7⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 188
        8⤵
        Program crash
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        6⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7277.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        8⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        8⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 188
        9⤵
        Program crash
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        7⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9710.exe
        6⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        7⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21017.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        6⤵
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35845.exe
        6⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27148.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40380.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        7⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 188
        8⤵
        Program crash
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10836.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32491.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
        5⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33914.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3766.exe
        6⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59969.exe
        6⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28440.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44674.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60429.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56462.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        7⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        8⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-666.exe
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        8⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5848 -s 188
        9⤵
        Program crash
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exe
        6⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62371.exe
        7⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12527.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4009.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60002.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3540.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        6⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        6⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        6⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18392.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        5⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57313.exe
        5⤵
        
        PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        7⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        7⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        7⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48118.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39070.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4009.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        5⤵
        
        PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45974.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe
        5⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        5⤵
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35497.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
      4⤵
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34438.exe
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
      4⤵
      PID:7024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44269.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22547.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17726.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        8⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        8⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        7⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        7⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        7⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        7⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        6⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        6⤵
        Executes dropped EXE
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        7⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13587.exe
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        5⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        6⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32491.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32430.exe
        5⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26987.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        6⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 188
        7⤵
        Program crash
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        6⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36800.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        5⤵
        
        PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        7⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
        6⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29161.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37572.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        6⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exe
        5⤵
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50733.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31061.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39390.exe
        5⤵
        
        PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        5⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14111.exe
        6⤵
        
        PID:992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        5⤵
        
        PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
        5⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        5⤵
        
        PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
      4⤵
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        5⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37572.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15962.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        5⤵
        
        PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20770.exe
      4⤵
      PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19353.exe
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
      4⤵
      PID:7072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12140.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        7⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        7⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12258.exe
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
        6⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        5⤵
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40758.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20079.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
        5⤵
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 188
        7⤵
        Program crash
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
        5⤵
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11193.exe
      4⤵
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        5⤵
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29436.exe
      4⤵
      PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
      4⤵
      PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54438.exe
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        5⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
      4⤵
      PID:832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40758.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36800.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
      4⤵
      PID:7120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43992.exe
      4⤵
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51465.exe
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60915.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        5⤵
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
      4⤵
      PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18237.exe
      4⤵
      PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
      4⤵
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe
    3⤵
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
    3⤵
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48773.exe
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
    3⤵
    PID:5204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
    3⤵
    PID:7056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4331.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4331.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3177.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        8⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        8⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        8⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        7⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        7⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        7⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        6⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        7⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48492.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        7⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
        6⤵
        
        PID:268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50733.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9572.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        7⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        6⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        6⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53871.exe
        5⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20126.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        5⤵
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        6⤵
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        5⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40926.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26625.exe
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11152.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        5⤵
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
      4⤵
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52783.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
      4⤵
      PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32150.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38123.exe
        6⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32491.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        5⤵
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9896.exe
        6⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        6⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
      4⤵
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43154.exe
        5⤵
        
        PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
      4⤵
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43058.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exe
        5⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26625.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11152.exe
        6⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7282.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60380.exe
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44096.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
      4⤵
      PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63696.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40758.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
      4⤵
      PID:7040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
      4⤵
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59706.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30709.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
      4⤵
      PID:5864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
    3⤵
    PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
      4⤵
      PID:828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
      4⤵
      PID:568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28215.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
      4⤵
      PID:6744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
    3⤵
    PID:2460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
    3⤵
    PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34438.exe
    3⤵
    PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33252.exe
    3⤵
    PID:6220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60299.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62767.exe
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        5⤵
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
      4⤵
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
        5⤵
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36575.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
      4⤵
      PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46592.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33884.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
      4⤵
      PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61816.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
      4⤵
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60188.exe
        5⤵
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
      4⤵
      PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51308.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
    3⤵
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
      4⤵
      PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43666.exe
    3⤵
    PID:296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
    3⤵
    PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18078.exe
    3⤵
    PID:4944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64086.exe
    3⤵
    PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
    3⤵
    PID:7080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19349.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19349.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39625.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        5⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        6⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 188
        7⤵
        Program crash
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        5⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15979.exe
      4⤵
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35009.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39070.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58298.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27909.exe
      4⤵
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
      4⤵
      PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
      4⤵
      PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
    3⤵
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16166.exe
    3⤵
    PID:3636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24372.exe
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
    3⤵
    PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42947.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42947.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
      4⤵
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4921.exe
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        5⤵
        
        PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
      4⤵
      PID:7228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
    3⤵
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
    3⤵
    PID:6540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
    3⤵
    PID:280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
    3⤵
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
    3⤵
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
    3⤵
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe
    3⤵
    PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
    3⤵
    PID:6892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8923.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8923.exe
  2⤵
  PID:1096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
    3⤵
    PID:4308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
    3⤵
    PID:7160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
  2⤵
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11207.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11207.exe
  2⤵
  PID:3304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7665.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7665.exe
  2⤵
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35215.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35215.exe
  2⤵
  PID:5472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
  2⤵
  PID:6680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe

Filesize
468KB

MD5
e35c6bd7a3d10900b802870bf839d6a0

SHA1
a9e1cb1d1c373ab33b3af1d50404c439b2cb2768

SHA256
b49bb4f8f2e759080da1ab627f75e31b7cca098f0e9e3657ab43a5c652155d76

SHA512
b8a3a238f0b62f9ac43e297e98f7765131a07e2aa08301c685cc3bca5c706ec54fc54a7f975b259f87a8cd8460b231eb54cac42f0e485d7d3bf2801530db1e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe

Filesize
468KB

MD5
7e3938a2565450eec16fa28e40613443

SHA1
ed71ab602c3477df85051259302fef9b8c3faad7

SHA256
0123a0ba1437960c39dc3b9da2fc716dec246bddb7bd423fd175640180e1ebf6

SHA512
09a3180c389288d3fd5b6264fd54630cc0f23a0af21f2befad9a6c780dacc8394b244696addb348843b872a3cc2cab622088a529f77906608d126f004e1fbc02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe

Filesize
468KB

MD5
f10ba515c3a8c41e4a9881c612e76ad7

SHA1
a3e87594988f303c5fffa38d8e73f77209da4a18

SHA256
925e6fa5f0ae782868816e55ea7eec9d747cfc88f4cf8ce5bede17388053051f

SHA512
4be1dfde0d8b7af2a93ded61a0fc5dc8770d0f19bdb9e643502876a254e16b233820c3ae5f56adc10e0796b49910c5ab57b10c68bf4ebce392b522923c5a484e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44269.exe

Filesize
468KB

MD5
a8f893e39ca3d94c2b3d9192303ed5e6

SHA1
bbe833355f335d4420f4124ac8b1124ec56bf964

SHA256
311b35cd55738d35d05e7a87dd35ad0487492074499c1ced153bcb166483f34d

SHA512
752a8d20a1c583ee7ddf18149e57661d91bc72215011966f9b6914e924ea344bca1450e8a48882153cd0aef6f07babbc3cc5676b3efd2a0a09ee25aa4fcadaec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe

Filesize
468KB

MD5
1df422728b01b68e5f8c72a1d5c36cdd

SHA1
00011161a21abc95d8abe5f555df576708ed763a

SHA256
c61444af76b2f4d0ad4016782393b210eab29962d982ccb7c58e8aefe39627d5

SHA512
10f43738d5aa676dbaf1ff8bd7969299f0dcaad784b9b48651af8f8d7a4e37748137384654e2c5a1dc07f9ccf24dd0881372acc2caa17cdb58f2e3cb0e66f364

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe

Filesize
468KB

MD5
3542f547425239be6d7233d6e809d68b

SHA1
13b6e39376df2a40a14145101944c5624cd870de

SHA256
0e68982d43fd613dfc105c33af64e1d474e02be00bafa072f6a0fe125c6ec03b

SHA512
0e73bbe2c630399d112b463f48f7363dc7be44663d6159642c2a838b4236e1b1b21096618710ef47ff0a5bbaf30188250af92f5c02ef72f8dd39454e14057a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe

Filesize
468KB

MD5
f862c66aecb661d17e712101a287097e

SHA1
69bfd06e76d9a3f595d57c8bb2feec9595a71077

SHA256
e4870b2bf7a366c96e10e709cbb76d2d6eef4d9163a956ae63d97c614aef9ab1

SHA512
da9590876123373841c1db83c1152a5989dfd553aa2d1897b8cc46249737ebca36d50cb53b1ef0615fccba2a6904fc2d6e5fa552b323a7612f7629eb19b6a2d2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12140.exe

Filesize
468KB

MD5
a05fe333c77b997378b0b6e1b1afdb02

SHA1
6c4d352688bc13b346f77e16cdd01f77400c95ac

SHA256
e2acb5552355a6750c78b3047789202c1158af592d458d2fe59f6e732bceed23

SHA512
def7923b4353af7b39ba3513af2294870b956ca4ea4fd99efe5fad99cdd2fe6e865676f2194f0290bf6f0e4a0066ad544fed50d8b623fd89486b0f6e7a374db5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe

Filesize
468KB

MD5
2ca746bc5adf70cb85f4c7b7579ef257

SHA1
5689c4761f67a92b7e74f593971bbf64d42f7714

SHA256
a8b177dc54555cc6a3c00d5a4426c7e0de4d637fb607b3462b64da527ee4c9b5

SHA512
85787efdce2eda7fb1f5a3876d755b780e272b70bf1d7d30f3c3b90a4ed61738d56b98ce4e6ff9239aadcdbb325bca4f15bbbe3f955b5b46c01997b000fbf0a9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15671.exe

Filesize
468KB

MD5
9dd1a4534808e3b227908dc8c99c8a22

SHA1
400a1ac548b9fc39040fd2837924d7733821bad1

SHA256
8ba25516dabd3e7682185b2ecf65b8d0c1edf24e792b048a0abf8876e224a205

SHA512
89df09014217a33a4cd49654f7cb53e76c0efbd3bd340bc2ab72b6d4e9719089214579f6f6482dc9c77d0199a5d557380edc20d04602f9af239554aa3d750179

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19349.exe

Filesize
468KB

MD5
48c4ce352be73a90d99218e703140feb

SHA1
2ffbba81b9ff3269e2774af205b6c46fddc28481

SHA256
ab1f36e0b9b7e931c14a00e91580ae73a46a0b4f8761bc12bfc19dcb4572acbf

SHA512
2482e9e24f6a1e9ff8244758b3df4ab0d3ef7809daa6fd4f211672e71134c82b70f0079921334ef939d87859b2cbac9dde52c8c39d262a692cfc23db729c81b1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22547.exe

Filesize
468KB

MD5
9b96439b97e796cbda8865351b45cf27

SHA1
110abc6526a2ee606c75c04b6904c12296c8ae7d

SHA256
174ca6b3133645bc57fcaec7b013584dbe377798d7f5f65dcd3a713156a78303

SHA512
ca2a480420e1c5486fe1cb8c79304bae856704394c57ee66f83b344fb6ca70018a1eb9cb8c3ee8c3352d230ca981fc09020dbfc6bcfc2e95fe8e11cd381433df

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4331.exe

Filesize
468KB

MD5
59eebe08c88bb34fb6647e4a9eadb627

SHA1
e4728548eed4d19365748ef004f660e13fa77fb2

SHA256
4f2ef4da35fd95fa1bca49e36f7289b45c4ff130da76f0ac07cba54891fcb795

SHA512
07e8cb8dd6ea9a4ede6a6bb9d626549f63a2b02a88bfe3ff912e9e45ae18440cfc93bbb89b6f6b66a048bc9805685f85500846d7b71d181a00d096076f49395b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44674.exe

Filesize
468KB

MD5
dd3d393d5c39c00a3880c35db6af83c3

SHA1
66c3296da0cd456be5b0c357baf6f7f65cfc88f7

SHA256
18b7e890ca9972eb0d55f8de75bff9ccd570f67cc4a7e9b59553c2cfa972c623

SHA512
7b8b2b252b46782807a47d69765b7cfb1090a10ebcaa8be14e4ea026a7c74c6ba591178144c158c77259078abb3159f011a39c1463e142c2ad595d422ee3dab3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe

Filesize
468KB

MD5
bb5c6b262279c67d89aa22889ed093d7

SHA1
ca0d1b08f4b95ca147ffaaf577e8fbfbab101763

SHA256
f75a5de1575bc6a8a01f18aa65fcf53a0dbcb771ad22a606190d98ef6d8df45e

SHA512
53e5f634a6b8c2468bfc41085d47f86430c66ae6675b1f006361ac58aeb3cf6e164cb03436a49c0041cf015e88960907913ea172fd6d256ee906c4c4d6370557

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55660.exe

Filesize
468KB

MD5
228b8b674c5ce9022a213c6b2f612a3c

SHA1
176ca83d7cbf643cebdf1f504af91a9c7db75350

SHA256
000c178e602a1ec0624e5363c2ea4c828a41843639aa9ea8f686424185aaaece

SHA512
2c4c6b24c8284eda0497ceed97025e2d082de0cf614170660b4bdaed3bf81c0b145799834a24459915ef58ecdd76a8bfabd337ab2b8477c3d7ed31ad58d24979

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe

Filesize
468KB

MD5
308e044a96360f3b13f65deb4d9ae9c1

SHA1
d6b89c73f2c63ffa757474983062734b169ed7a0

SHA256
aa7fd6e5184ec7899555d336db92ffde544a1eb42d8bdd72fc9ec13bc2c02b76

SHA512
e6e080a2517d1fe48ca1192f568f7435d0699b08ebf1c2324a9a6396806d361fa5fa965061fa0a8aa82a8e3ccb2a9c7359982061f368b237d589f5746c6080c1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60299.exe

Filesize
468KB

MD5
d2f59321381bf3d6f299bb3fe40c3660

SHA1
5d70310935f9354e6177a357e4cbb4bdc1308af8

SHA256
5abbb703b9c5a84265cddb355fe4247d25a4cd57f45657343e85a2372897afd0

SHA512
52b134ed217f4a7cd02dd69220f0f85b5ade70311b7e1905c3f66036c0275b62dfef57c672e0d3cfc185f9c044c8655f8dd8777cedb0eaca1c31097a2523c324

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe

Filesize
468KB

MD5
d32b8b9393022160c1bc53610fc7debd

SHA1
5967d622c180a26423e2d499943b59d7957529a9

SHA256
78a5c540c5383a3bae2f52681f2a92833bb44e42e6f317a28cbb5bd07a9ba9b1

SHA512
270bdba1db2049681ae72f14ef387dcf2a3a6908b45258c1baf5fd1c4e4ec52a66a7c8bc99a0afe282dc28d559f2d8a6c90ea167c6cd3275371496c2679f04f7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe

Filesize
468KB

MD5
ab612b0a8cecf650dc6f0c7c20ddd52d

SHA1
12dc47c130457b7983ba311ac11538460fc53779

SHA256
4defeef307f763e17b0ddcfec469aefcdb4a15b8ce675d611d118575d845d76d

SHA512
055089b827bc4e31d08176d6e224d4a17acc9a01d9a318f717ede043aafacf0b0582f0e4a7f274c482d34b89c996a6728f32d2429bc2e3c217b330556d1146a6

Download Submit