3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
Size

468KB
MD5

8ab5ef2b3f2a09adc86e64518527e330
SHA1

d9e83eab826ac0f9d98ed78146c01dcac3b6d507
SHA256

3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6f
SHA512

c308c33162efb31412f58c9bae3cc466e2d1eba7a55cd78e2083790881c373047e86189e068275086ff7d805d4181cf96a33aab9d61d91082fd7a37c4aa4a765
SSDEEP

3072:1GeHo5IKq05UDbYpH5cOcf8/LChz10p1nLHewVPPEPY+VvmsvRl2:1Guoe8UDuHSOcf5YIsEPfZmsv

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2776	Unicorn-28253.exe
2564	Unicorn-48907.exe
2788	Unicorn-12212.exe
2672	Unicorn-40729.exe
2608	Unicorn-32268.exe
2172	Unicorn-23708.exe
2876	Unicorn-53920.exe
1216	Unicorn-60794.exe
2176	Unicorn-23715.exe
1276	Unicorn-58298.exe
1944	Unicorn-8220.exe
1740	Unicorn-8796.exe
2744	Unicorn-2666.exe
1788	Unicorn-41972.exe
2192	Unicorn-22371.exe
2360	Unicorn-33317.exe
2396	Unicorn-8817.exe
2296	Unicorn-14183.exe
2392	Unicorn-55019.exe
596	Unicorn-35153.exe
888	Unicorn-2637.exe
1664	Unicorn-62044.exe
2116	Unicorn-32657.exe
2420	Unicorn-51153.exe
2528	Unicorn-9742.exe
1912	Unicorn-18673.exe
624	Unicorn-54536.exe
2976	Unicorn-54801.exe
2304	Unicorn-37972.exe
708	Unicorn-2647.exe
2320	Unicorn-64898.exe
376	Unicorn-1493.exe
2704	Unicorn-26294.exe
1568	Unicorn-26294.exe
2504	Unicorn-47933.exe
2804	Unicorn-39484.exe
2248	Unicorn-36199.exe
2748	Unicorn-40025.exe
2148	Unicorn-6174.exe
2612	Unicorn-44.exe
2616	Unicorn-22629.exe
2560	Unicorn-42578.exe
1408	Unicorn-53465.exe
816	Unicorn-8296.exe
2948	Unicorn-8561.exe
2536	Unicorn-8561.exe
1144	Unicorn-27995.exe
2828	Unicorn-113.exe
2256	Unicorn-113.exe
492	Unicorn-689.exe
2136	Unicorn-57296.exe
3012	Unicorn-424.exe
972	Unicorn-13268.exe
1488	Unicorn-46133.exe
1548	Unicorn-27035.exe
2400	Unicorn-27781.exe
2168	Unicorn-46527.exe
1856	Unicorn-29505.exe
2064	Unicorn-34680.exe
948	Unicorn-6910.exe
268	Unicorn-32376.exe
944	Unicorn-41705.exe
2960	Unicorn-55204.exe
2324	Unicorn-26890.exe

Loads dropped DLL 64 IoCs

pid	Process
2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
2776	Unicorn-28253.exe
2776	Unicorn-28253.exe
2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
2788	Unicorn-12212.exe
2788	Unicorn-12212.exe
2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
2564	Unicorn-48907.exe
2564	Unicorn-48907.exe
2776	Unicorn-28253.exe
2776	Unicorn-28253.exe
2672	Unicorn-40729.exe
2672	Unicorn-40729.exe
2788	Unicorn-12212.exe
2788	Unicorn-12212.exe
2876	Unicorn-53920.exe
2608	Unicorn-32268.exe
2608	Unicorn-32268.exe
2876	Unicorn-53920.exe
2172	Unicorn-23708.exe
2776	Unicorn-28253.exe
2172	Unicorn-23708.exe
2776	Unicorn-28253.exe
2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
2564	Unicorn-48907.exe
2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
2564	Unicorn-48907.exe
1216	Unicorn-60794.exe
1216	Unicorn-60794.exe
2672	Unicorn-40729.exe
2672	Unicorn-40729.exe
1944	Unicorn-8220.exe
1944	Unicorn-8220.exe
2176	Unicorn-23715.exe
2176	Unicorn-23715.exe
2876	Unicorn-53920.exe
2876	Unicorn-53920.exe
1740	Unicorn-8796.exe
2788	Unicorn-12212.exe
1740	Unicorn-8796.exe
2788	Unicorn-12212.exe
2172	Unicorn-23708.exe
2172	Unicorn-23708.exe
1788	Unicorn-41972.exe
1788	Unicorn-41972.exe
2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
2744	Unicorn-2666.exe
2744	Unicorn-2666.exe
2776	Unicorn-28253.exe
2776	Unicorn-28253.exe
1276	Unicorn-58298.exe
1276	Unicorn-58298.exe
2192	Unicorn-22371.exe
2192	Unicorn-22371.exe
2608	Unicorn-32268.exe
2608	Unicorn-32268.exe
2564	Unicorn-48907.exe
2564	Unicorn-48907.exe
2360	Unicorn-33317.exe
2360	Unicorn-33317.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	2932	WerFault.exe	142

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33521.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
2776	Unicorn-28253.exe
2788	Unicorn-12212.exe
2564	Unicorn-48907.exe
2672	Unicorn-40729.exe
2608	Unicorn-32268.exe
2876	Unicorn-53920.exe
2172	Unicorn-23708.exe
1216	Unicorn-60794.exe
2176	Unicorn-23715.exe
1944	Unicorn-8220.exe
1276	Unicorn-58298.exe
1740	Unicorn-8796.exe
2744	Unicorn-2666.exe
1788	Unicorn-41972.exe
2192	Unicorn-22371.exe
2360	Unicorn-33317.exe
2396	Unicorn-8817.exe
2296	Unicorn-14183.exe
2392	Unicorn-55019.exe
596	Unicorn-35153.exe
1664	Unicorn-62044.exe
888	Unicorn-2637.exe
2420	Unicorn-51153.exe
2116	Unicorn-32657.exe
1912	Unicorn-18673.exe
624	Unicorn-54536.exe
2976	Unicorn-54801.exe
2528	Unicorn-9742.exe
708	Unicorn-2647.exe
2304	Unicorn-37972.exe
2320	Unicorn-64898.exe
376	Unicorn-1493.exe
2704	Unicorn-26294.exe
1568	Unicorn-26294.exe
2504	Unicorn-47933.exe
2804	Unicorn-39484.exe
2248	Unicorn-36199.exe
2748	Unicorn-40025.exe
2612	Unicorn-44.exe
2148	Unicorn-6174.exe
2616	Unicorn-22629.exe
1408	Unicorn-53465.exe
2560	Unicorn-42578.exe
816	Unicorn-8296.exe
2948	Unicorn-8561.exe
2536	Unicorn-8561.exe
1144	Unicorn-27995.exe
2256	Unicorn-113.exe
2828	Unicorn-113.exe
2136	Unicorn-57296.exe
492	Unicorn-689.exe
3012	Unicorn-424.exe
1488	Unicorn-46133.exe
972	Unicorn-13268.exe
1548	Unicorn-27035.exe
2400	Unicorn-27781.exe
2168	Unicorn-46527.exe
1856	Unicorn-29505.exe
268	Unicorn-32376.exe
948	Unicorn-6910.exe
2064	Unicorn-34680.exe
944	Unicorn-41705.exe
2960	Unicorn-55204.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2776	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	30
PID 2668 wrote to memory of 2776	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	30
PID 2668 wrote to memory of 2776	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	30
PID 2668 wrote to memory of 2776	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	30
PID 2776 wrote to memory of 2564	2776	Unicorn-28253.exe	31
PID 2776 wrote to memory of 2564	2776	Unicorn-28253.exe	31
PID 2776 wrote to memory of 2564	2776	Unicorn-28253.exe	31
PID 2776 wrote to memory of 2564	2776	Unicorn-28253.exe	31
PID 2668 wrote to memory of 2788	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	32
PID 2668 wrote to memory of 2788	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	32
PID 2668 wrote to memory of 2788	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	32
PID 2668 wrote to memory of 2788	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	32
PID 2788 wrote to memory of 2672	2788	Unicorn-12212.exe	33
PID 2788 wrote to memory of 2672	2788	Unicorn-12212.exe	33
PID 2788 wrote to memory of 2672	2788	Unicorn-12212.exe	33
PID 2788 wrote to memory of 2672	2788	Unicorn-12212.exe	33
PID 2668 wrote to memory of 2608	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	34
PID 2668 wrote to memory of 2608	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	34
PID 2668 wrote to memory of 2608	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	34
PID 2668 wrote to memory of 2608	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	34
PID 2564 wrote to memory of 2172	2564	Unicorn-48907.exe	35
PID 2564 wrote to memory of 2172	2564	Unicorn-48907.exe	35
PID 2564 wrote to memory of 2172	2564	Unicorn-48907.exe	35
PID 2564 wrote to memory of 2172	2564	Unicorn-48907.exe	35
PID 2776 wrote to memory of 2876	2776	Unicorn-28253.exe	36
PID 2776 wrote to memory of 2876	2776	Unicorn-28253.exe	36
PID 2776 wrote to memory of 2876	2776	Unicorn-28253.exe	36
PID 2776 wrote to memory of 2876	2776	Unicorn-28253.exe	36
PID 2672 wrote to memory of 1216	2672	Unicorn-40729.exe	37
PID 2672 wrote to memory of 1216	2672	Unicorn-40729.exe	37
PID 2672 wrote to memory of 1216	2672	Unicorn-40729.exe	37
PID 2672 wrote to memory of 1216	2672	Unicorn-40729.exe	37
PID 2788 wrote to memory of 2176	2788	Unicorn-12212.exe	38
PID 2788 wrote to memory of 2176	2788	Unicorn-12212.exe	38
PID 2788 wrote to memory of 2176	2788	Unicorn-12212.exe	38
PID 2788 wrote to memory of 2176	2788	Unicorn-12212.exe	38
PID 2608 wrote to memory of 1276	2608	Unicorn-32268.exe	40
PID 2608 wrote to memory of 1276	2608	Unicorn-32268.exe	40
PID 2608 wrote to memory of 1276	2608	Unicorn-32268.exe	40
PID 2608 wrote to memory of 1276	2608	Unicorn-32268.exe	40
PID 2876 wrote to memory of 1944	2876	Unicorn-53920.exe	39
PID 2876 wrote to memory of 1944	2876	Unicorn-53920.exe	39
PID 2876 wrote to memory of 1944	2876	Unicorn-53920.exe	39
PID 2876 wrote to memory of 1944	2876	Unicorn-53920.exe	39
PID 2172 wrote to memory of 1740	2172	Unicorn-23708.exe	41
PID 2172 wrote to memory of 1740	2172	Unicorn-23708.exe	41
PID 2172 wrote to memory of 1740	2172	Unicorn-23708.exe	41
PID 2172 wrote to memory of 1740	2172	Unicorn-23708.exe	41
PID 2776 wrote to memory of 2744	2776	Unicorn-28253.exe	42
PID 2776 wrote to memory of 2744	2776	Unicorn-28253.exe	42
PID 2776 wrote to memory of 2744	2776	Unicorn-28253.exe	42
PID 2776 wrote to memory of 2744	2776	Unicorn-28253.exe	42
PID 2668 wrote to memory of 1788	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	43
PID 2668 wrote to memory of 1788	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	43
PID 2668 wrote to memory of 1788	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	43
PID 2668 wrote to memory of 1788	2668	3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe	43
PID 2564 wrote to memory of 2192	2564	Unicorn-48907.exe	44
PID 2564 wrote to memory of 2192	2564	Unicorn-48907.exe	44
PID 2564 wrote to memory of 2192	2564	Unicorn-48907.exe	44
PID 2564 wrote to memory of 2192	2564	Unicorn-48907.exe	44
PID 1216 wrote to memory of 2360	1216	Unicorn-60794.exe	45
PID 1216 wrote to memory of 2360	1216	Unicorn-60794.exe	45
PID 1216 wrote to memory of 2360	1216	Unicorn-60794.exe	45
PID 1216 wrote to memory of 2360	1216	Unicorn-60794.exe	45

C:\Users\Admin\AppData\Local\Temp\3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe
"C:\Users\Admin\AppData\Local\Temp\3fa237dc843d1c9897516afab6f82638a3634bf109b157c6429e70feb7626b6fN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23708.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        8⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        8⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        7⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
        7⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55509.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        7⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19844.exe
        6⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        7⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45989.exe
        8⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        8⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        8⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        7⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50531.exe
        6⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29826.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59485.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6157.exe
        6⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        6⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30485.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22371.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        7⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58257.exe
        7⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
        6⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37344.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29897.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46527.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9387.exe
        6⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        7⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
        7⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        6⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        5⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35057.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
        5⤵
        
        PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64860.exe
        6⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        7⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48728.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58257.exe
        6⤵
        
        PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        5⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40627.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        5⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
        6⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17044.exe
      4⤵
      PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4293.exe
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
      4⤵
      PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7406.exe
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53920.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26294.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exe
        8⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24666.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
        7⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        7⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7757.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40174.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
        8⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38032.exe
        8⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        7⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        7⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exe
        7⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39484.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        6⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
        7⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26970.exe
        6⤵
        
        PID:304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        5⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46836.exe
        6⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        6⤵
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46918.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40025.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        6⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        7⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        6⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        6⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11871.exe
        6⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
        5⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        6⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26917.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46918.exe
        5⤵
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34307.exe
        5⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6762.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37072.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5977.exe
      4⤵
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33044.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22369.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        6⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
      4⤵
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
        5⤵
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
      4⤵
      PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
      4⤵
      PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
      4⤵
      PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40174.exe
        6⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        7⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        6⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        6⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        5⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
        5⤵
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6157.exe
        5⤵
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        5⤵
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33083.exe
      4⤵
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
      4⤵
      PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31391.exe
      4⤵
      PID:6940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54536.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-113.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45140.exe
        5⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        6⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
      4⤵
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59869.exe
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
      4⤵
      PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33236.exe
      4⤵
      PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
      4⤵
      PID:7036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39539.exe
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17557.exe
    3⤵
    PID:3868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4400.exe
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
    3⤵
    PID:5244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7231.exe
    3⤵
    PID:6392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60794.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55204.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46836.exe
        8⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
        8⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37072.exe
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
        7⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        7⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26890.exe
        6⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        7⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        7⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        6⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        6⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        6⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        7⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
        6⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35070.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        6⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        5⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
        6⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38032.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52036.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14437.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26294.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26554.exe
        6⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        6⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51420.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
        5⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        6⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 188
        7⤵
        Program crash
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3034.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        6⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        5⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54294.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        6⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36199.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13372.exe
        5⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
      4⤵
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
      4⤵
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33625.exe
        5⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21291.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
      4⤵
      PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
      4⤵
      PID:6168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55019.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        6⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38537.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62909.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        5⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57368.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        6⤵
        
        PID:284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37072.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        6⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54410.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        5⤵
        
        PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25506.exe
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
        5⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe
        5⤵
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27.exe
      4⤵
      PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62292.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
      4⤵
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
      4⤵
      PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62044.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25698.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        6⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        5⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61079.exe
        5⤵
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50531.exe
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38537.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12639.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
      4⤵
      PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
      4⤵
      PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61001.exe
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
        5⤵
        
        PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-457.exe
    3⤵
    PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
      4⤵
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
      4⤵
      PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13950.exe
    3⤵
    PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
      4⤵
      PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exe
      4⤵
      PID:7108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46458.exe
    3⤵
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
    3⤵
    PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
    3⤵
    PID:6176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32268.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32268.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58298.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54801.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-689.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
        6⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60520.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
        7⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        6⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        7⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30215.exe
        5⤵
        
        PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58416.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe
        5⤵
        
        PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40300.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        5⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13105.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
      4⤵
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
      4⤵
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34355.exe
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
      4⤵
      PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
      4⤵
      PID:6384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14441.exe
      4⤵
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58257.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe
      4⤵
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4280.exe
        5⤵
        
        PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54593.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36000.exe
      4⤵
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
      4⤵
      PID:6552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
      4⤵
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        5⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
        6⤵
        
        PID:660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        6⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        5⤵
        
        PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
      4⤵
      PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
      4⤵
      PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
      4⤵
      PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29359.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
      4⤵
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45764.exe
    3⤵
    PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53108.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6157.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43095.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61201.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51829.exe
      4⤵
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        5⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
      4⤵
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
      4⤵
      PID:7052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
      4⤵
      PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7015.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52536.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
    3⤵
    PID:3424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
    3⤵
    PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
    3⤵
    PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34680.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
      4⤵
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29262.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
        5⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        5⤵
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13105.exe
      4⤵
      PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38980.exe
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
    3⤵
    PID:3680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
    3⤵
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
    3⤵
    PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
    3⤵
    PID:6204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25698.exe
    3⤵
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8852.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37072.exe
      4⤵
      PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
    3⤵
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33521.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
    3⤵
    PID:6608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
  2⤵
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
    3⤵
    PID:3000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32166.exe
    3⤵
    PID:6320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9485.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9485.exe
  2⤵
  PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
    3⤵
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
    3⤵
    PID:4648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
    3⤵
    PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
    3⤵
    PID:6648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
  2⤵
  PID:3488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18159.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18159.exe
  2⤵
  PID:4876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18700.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18700.exe
  2⤵
  PID:5392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
  2⤵
  PID:6560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe

Filesize
468KB

MD5
ecd434896236370ffabd50c0c3d83d6a

SHA1
e8d097d2e3c53c063a1de8ad7dd7d052f8e6d358

SHA256
11849338027879d49ea39588746e37fcbe135cded37d38d3accf567572b5394c

SHA512
4ee14f09f827b99af05ac499f65fb091491043af422039d8c13d8e7d22486220f78f37f404e3de85ae34c81d618e37c9719856ad4e2f982d5c347cc41076b31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37344.exe

Filesize
468KB

MD5
559adc971ba586770274f33e88285e55

SHA1
8c8d6df59e45c63bae415c3f5c26862d19b86292

SHA256
d538a52e214c58d1663a7be2c919346625dc75227f9ff4e3ae9b53a82128e69e

SHA512
51b5c0e203e5bdc39852f6bd0113c2a96a8865dff87c0de19d13e8f7d1c497866336d9ec13b4a150933c8d945f4da7f939335976ade4dc224dcae6d68f4026cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40300.exe

Filesize
468KB

MD5
b79fc69d5cd51c022cf2c81d9dd2383a

SHA1
e9db4242863141f485b4ee1144e10f8a34de3d80

SHA256
92b3d2abc91f33c39bc0f12f66c18dadfafb7486c554b0a2a4edb48cd3467787

SHA512
68c7485334dd12f0326bbed71474c811625ea3e24b06fd26917b4f4c0201084bfcc9c1b899c9cc01f20dc0cb01f884be7257a3508b62930ae823a5920959c4a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-457.exe

Filesize
468KB

MD5
9d7ee82152f53db187128bb8519f41cf

SHA1
aa0accf7e8b87da03faf2d726a29c4e196901bf7

SHA256
b14016fb9f5cd45ff48533c3332f594dab81f3d6ca2af09aced9f5ad5c01846c

SHA512
e4eb525983306b64d0c36c015a0343d748e7407c88ae15b63ef9e4f9854e8f95bd5aca4f3352f3e0755e994d751ceccd0af9c3d3e94a08086b9cf936035fe519

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53920.exe

Filesize
468KB

MD5
ab7b3a1b4f637cfd97b6516393323603

SHA1
f53a8bc20017650749a1775ce23d3fdccf49435c

SHA256
928d9d634983e8f0970a9ada4bed600b5d0cc3c5933c8fa2681951c290daee6d

SHA512
2eda9bb202cf369233d12c052ce7085632143d2c3250501373c35af4344cd9f3579727b0d115b576017cc459f10a7ce46264b8a302fd6f7255bc902d25f6746f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58298.exe

Filesize
468KB

MD5
44edc7100cd04f65f9ab68cf8ff2cf12

SHA1
ce7dc4600afa6c7256819d56d68d87ea2101ff89

SHA256
c74809754458d978815c0af1a0a50426044b975d955b479d216218153c1053e1

SHA512
2241d33a3b8766252c7c767f7ca94d070842a9b4d7e2bb9973ab669e3e209168242fddd407d6b898f1b672f6202ab0f6cce543aa4fbfcbc6c9217b667fd64baa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58416.exe

Filesize
468KB

MD5
26b7c6128db0f93d86bd1075e6851e6c

SHA1
a749f3c9925ffa60c97a3d003f37aab3d0d0452f

SHA256
515f08b5fe564be6cd7c2de0245d5fdc1de61ecdcd99f8a80d980423357b9c7e

SHA512
9bcd76be771ff726c0756c1604d422bd03151fdad2baeb14f60c05844247342bc3602d04029d23db558f608a41002d666a9e7d91d488fce4d656096573646ce4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe

Filesize
468KB

MD5
fa63c7a79d50021506254366cf87ff9b

SHA1
c89b1146fb8e2cbace05955789e67e0ff2d2f5a4

SHA256
d52ef98c71a67cbe01910b0b9c4417e04171f09c2ffde1d838d4afb4aa09076e

SHA512
c2d4d56263af720bab3d5d8deba314dedb73666d094f97d149f69a76c635e6723e04673149ab164b001ce3666373f05b5d0cf878134479c583264ea5ce6aaaf6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe

Filesize
468KB

MD5
0e23cdad925f5df326143a130451df30

SHA1
b63867b240d5a40d44c5acac04ccab70b5eeb9aa

SHA256
9558925bd8a19b036c8ed2e8d3b0822ca52ed74dde852421778aa9874dd6dc64

SHA512
0d4ae13d9d554696fd15f270fd8f29875e1a25d94333e2550c9ffffb6685bc11495f0dd5580069255f14db5997d800a5ac58cc892b7c3f68ac05551005fdd374

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22371.exe

Filesize
468KB

MD5
498afd036de7729d3105020ecffbf94e

SHA1
197fc16be80e7d2ae9bd322f91ed61ea6fb4cec0

SHA256
2db4445a47c0e1fec022af65352d8255dbfd6bbb840e75621daab00f07c4c5a4

SHA512
fcedd6a554c99458f4a01d35f242317bad1d50113cb65b0d4c202c6e7072abc75f971c8f12eb9268fbca4d6279cd8171ee3447998117b962c5c36babd7d39c5a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23708.exe

Filesize
468KB

MD5
42c64a70c15966d3c56dbb9b0c06554a

SHA1
016df69aac5a0b04c6da40c62d0474ef61633598

SHA256
d4a2000277ad718bc938fe1aa2768dee15a57fa4abd58b97da8dbcaa7b1a610a

SHA512
78b5aff542138ba4f143fd04444d5fed193b7760ae9bae2069312e3397f21589526ab6ff43703b2816c9fa36fcd1e1987826d536f6b22a57e29ec65154a0c4b2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe

Filesize
468KB

MD5
a27781f01c10a0726e04fdefb7300045

SHA1
b3feeff448b37d461b925ba41b875b046b35eab9

SHA256
5c79dd8392ed0abbe69dccf55eb6e011fbaf88977acd680cc968c0ccac879e0c

SHA512
41205a8c1ff73dc5461e8a852e36e340680a1cbf9fd5fa06808d7454414acb48b1c870badfa247e663753c798cab23c0a0091004b7843488fc1c9b07e83e9645

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe

Filesize
468KB

MD5
f89cd3dbe44d73155c20abd3710a0f17

SHA1
8e7e0827f775617308129b8ca66f84714bacd08b

SHA256
cd43137e180f0cc2b263d6abcf5c419d7167552f249d11bebf0a4d2e74fc9b4e

SHA512
2be5fdc43b72d1dea32e0d0bc0e1f0141b8cc097ce58fd1f7babf29f6784ed3c327a51201a2b0bc95d19ada303fc2ab014801f13d81935006fc7a1d7b65597a5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe

Filesize
468KB

MD5
e8348f8b839fa3414fe44878c8f604a8

SHA1
acefde42a67202f468d88bc2f009f1c922255179

SHA256
04cd91b768de98fdc44fea256202aea09674de5164ac11b5ba22b069bd9df2f2

SHA512
65b3db22a585021b112539c6fcd677f958f6e24c38aaf0f7d5215a51eeb20d45398500cdc6938e3acf2e52b04a1c71671d2539683c9fdd8d84fd608227ae9409

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32268.exe

Filesize
468KB

MD5
6ffe8ce5598369b7bc47bda2abe59c0c

SHA1
7dc2503ed68dfce7cdb8ff71cfd8c9ce42f6f063

SHA256
2235582358bf4a1a192f1547ee488ae21977d5763fd501d90a5e323065190abe

SHA512
62470b16b6593789a37bbd9ec0b3f9bb6b290e5da9cde8405060ceb660bb8a9ad3c1df20a01fc88183f6b3512a3b6178eea583913c8a1c9c9fd8dde7768c4e89

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe

Filesize
468KB

MD5
0c46567316d89ac3728941f22e912db7

SHA1
75af1bc432adaaee9bf328f40b696c532e18a72a

SHA256
ca99498c0aae01b38c660063708ec049ce821d13096ad9e3b89411b20924a5dc

SHA512
5bb8a26fab3f20eac67836355c2f44a82c7c4c43bc197019eaa9474c279b097796257e1b947fcecfc1e76ad1592730a46d744a5da189e69024bac0707f66b131

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe

Filesize
468KB

MD5
61514ee259afecf6a088b7674cb9a5f7

SHA1
5dc66f1e8e353e88753fa944d799ed2881bb4694

SHA256
3611f1bd9d37669dc04900f64738dc0631ef81d3e675b8bfaf42c2d8bcbafb63

SHA512
b2ace97d9604a7c0088a2fce8849de8594f8ccd0e9dda2106e0fdfdf020b0a977642cd263ecc93aeadaff4a8834fafc76b063985f1f284fd613ff4a5ed591da6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe

Filesize
468KB

MD5
6c75f39472e35e181bb240e0a5dca77c

SHA1
ecf8426702ef2c7de094feba8ea18e7317e56064

SHA256
229e89797ef46dbe87e8de2c2fcb08275281c4707bfebebdf822fe6ffc2649cc

SHA512
edb812e0b488d9bcf2e4d3eaea2f56970f922ab80f2dc1c803017bfabc43e6eef40e3cc9b68bf309d6e5248c36ff70834e8e043a9ad1cfc9fc53ebcc714a8515

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe

Filesize
468KB

MD5
4d60ef00e8c88eb51926c8edde58dcc4

SHA1
0ae784ee00bd73ab39534e15c288e09f062aeaa1

SHA256
79a847e69f9ec7125d42f5acc9f1a9f83140fba8c66b28d57f0fbfc660f7aa4b

SHA512
5db4af2145d674bab04d24f1803eeae0f788b8d92ed2658ef8577c3d7496a03fcad413f968e65fd17949bdf58fa2b1a8b0360f0f39a0df25175610aff6490a39

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60794.exe

Filesize
468KB

MD5
304e05d1e9a566c0410d552841494ad3

SHA1
3b56e29080a90db8b8df4008c72634c8f0807c13

SHA256
c3d3773d8c139dcae1a32df91cb4968f20bb791835765347191aafbe08d97fdc

SHA512
7c23256dd70e9352ff1aaf68a9c9902b7c529814b7398fc99305fa1c519539c17561e86458b6d16fc6a7ca5a81d89f65b9c8a4bc5d7530c8941f44b96eee2e36

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe

Filesize
468KB

MD5
b764b936db651bda1f7d7003c638f14e

SHA1
2142463c13dc1afe8c0fd22e1e6e32d57837d0ce

SHA256
694ec9de8ff9c52deb7e681f341c5ddccbd452d2c1619840b7db9853a660b518

SHA512
150b9173fb027badbb290ba7ffd4f14e225b10f42ad70170bfa24f0472d5cb17d22fb297091632277cc0ce2aeb9d0b1294d0e68ae844d7210a89f1496b610779

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe

Filesize
468KB

MD5
f2ba3145422da40e308bff4b2a490d4c

SHA1
bedd1c74c6128ee372323ee8226cbfa570ce66bd

SHA256
38a6002bb882dd5b6388d5399b0a0112564bf4cf6bb498a290064644ee4b74a1

SHA512
38ce792b3fb17b2736b6b65066fd7a096208f73fc2f8e4b77d03ebc2b90cc6df581e31d0487484131d60e46bec4eda255cd3ae10b119aa2160af9a2accc59dec

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe

Filesize
468KB

MD5
6b8735b176fad170d083049d2d784d3f

SHA1
960d3c0413d36d691cc0c2191a1d7a4c18f62fef

SHA256
b3948c6a6b594382108696581d3ebc2bcdeba2cc200f2a7add4fc35512966541

SHA512
d4cb83a8ea966b0577a7ea54fcb714ac4e11b8f648146536ae3994fc55679a82ae08325760f67e95665218cf45d98261c79be0896dc0de5715b05d4be2cc0aa5

Download Submit