d170286e8605531e991f05583c6f271cec3181e559ade9d3fd6e474ebec8ac83

Analysis

max time kernel
117s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63acff21c90be4591ab271cfd4043d50N.exe
Size

468KB
MD5

63acff21c90be4591ab271cfd4043d50
SHA1

9fbfa3c768c682fd03c5830841043feb22aa8910
SHA256

d170286e8605531e991f05583c6f271cec3181e559ade9d3fd6e474ebec8ac83
SHA512

b6af705b89c0d2fc5187e2a58db9d2056288d665be7826cf35a777a4915af33cb0e6827ce8ed5df52b809d680b779c0b3a78f0ba556f0f44df51fd83e5ef3930
SSDEEP

3072:WMvCo7L+jY8UEbY2PzGjofXiCh2WIpPZmHevVW7/CSFxLfNYzlW:WM6oi1UENPSjofN0bm/CORfNY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2532	Unicorn-8011.exe
2728	Unicorn-12453.exe
2892	Unicorn-62209.exe
2832	Unicorn-36019.exe
2628	Unicorn-53102.exe
2416	Unicorn-64799.exe
2968	Unicorn-25612.exe
2512	Unicorn-23056.exe
2976	Unicorn-19334.exe
2984	Unicorn-56880.exe
2880	Unicorn-32111.exe
2636	Unicorn-32376.exe
1148	Unicorn-18077.exe
2956	Unicorn-61519.exe
2284	Unicorn-23030.exe
3048	Unicorn-31752.exe
340	Unicorn-37372.exe
1972	Unicorn-61322.exe
2452	Unicorn-8208.exe
2332	Unicorn-65022.exe
1124	Unicorn-62976.exe
640	Unicorn-31966.exe
2408	Unicorn-31701.exe
564	Unicorn-31203.exe
1964	Unicorn-44218.exe
2044	Unicorn-40134.exe
2352	Unicorn-38088.exe
2496	Unicorn-61301.exe
2704	Unicorn-14114.exe
2940	Unicorn-52215.exe
2980	Unicorn-32349.exe
2764	Unicorn-9328.exe
2308	Unicorn-60383.exe
1908	Unicorn-64467.exe
2516	Unicorn-25280.exe
2348	Unicorn-31965.exe
1944	Unicorn-6906.exe
2960	Unicorn-35857.exe
940	Unicorn-47555.exe
2864	Unicorn-37341.exe
1904	Unicorn-16781.exe
604	Unicorn-61151.exe
1928	Unicorn-61706.exe
2180	Unicorn-36263.exe
1272	Unicorn-36263.exe
1156	Unicorn-13382.exe
976	Unicorn-27117.exe
956	Unicorn-32983.exe
344	Unicorn-4275.exe
1612	Unicorn-49070.exe
896	Unicorn-56491.exe
2500	Unicorn-56791.exe
2336	Unicorn-16720.exe
2096	Unicorn-23819.exe
2448	Unicorn-17301.exe
2904	Unicorn-42303.exe
2644	Unicorn-2303.exe
2840	Unicorn-6942.exe
1976	Unicorn-55204.exe
2856	Unicorn-6750.exe
2148	Unicorn-42952.exe
2844	Unicorn-64259.exe
2088	Unicorn-19600.exe
680	Unicorn-14154.exe

Loads dropped DLL 64 IoCs

pid	Process
2692	63acff21c90be4591ab271cfd4043d50N.exe
2692	63acff21c90be4591ab271cfd4043d50N.exe
2532	Unicorn-8011.exe
2532	Unicorn-8011.exe
2692	63acff21c90be4591ab271cfd4043d50N.exe
2692	63acff21c90be4591ab271cfd4043d50N.exe
2728	Unicorn-12453.exe
2728	Unicorn-12453.exe
2532	Unicorn-8011.exe
2532	Unicorn-8011.exe
2892	Unicorn-62209.exe
2892	Unicorn-62209.exe
2692	63acff21c90be4591ab271cfd4043d50N.exe
2692	63acff21c90be4591ab271cfd4043d50N.exe
2832	Unicorn-36019.exe
2832	Unicorn-36019.exe
2728	Unicorn-12453.exe
2728	Unicorn-12453.exe
2416	Unicorn-64799.exe
2416	Unicorn-64799.exe
2892	Unicorn-62209.exe
2692	63acff21c90be4591ab271cfd4043d50N.exe
2628	Unicorn-53102.exe
2692	63acff21c90be4591ab271cfd4043d50N.exe
2628	Unicorn-53102.exe
2892	Unicorn-62209.exe
2532	Unicorn-8011.exe
2532	Unicorn-8011.exe
2512	Unicorn-23056.exe
2512	Unicorn-23056.exe
2832	Unicorn-36019.exe
2832	Unicorn-36019.exe
2968	Unicorn-25612.exe
2968	Unicorn-25612.exe
2984	Unicorn-56880.exe
2984	Unicorn-56880.exe
2416	Unicorn-64799.exe
2416	Unicorn-64799.exe
2976	Unicorn-19334.exe
2976	Unicorn-19334.exe
2728	Unicorn-12453.exe
2728	Unicorn-12453.exe
2880	Unicorn-32111.exe
2532	Unicorn-8011.exe
2880	Unicorn-32111.exe
2532	Unicorn-8011.exe
2692	63acff21c90be4591ab271cfd4043d50N.exe
2636	Unicorn-32376.exe
2956	Unicorn-61519.exe
2692	63acff21c90be4591ab271cfd4043d50N.exe
2636	Unicorn-32376.exe
2956	Unicorn-61519.exe
2892	Unicorn-62209.exe
2892	Unicorn-62209.exe
2628	Unicorn-53102.exe
2628	Unicorn-53102.exe
2284	Unicorn-23030.exe
2284	Unicorn-23030.exe
3048	Unicorn-31752.exe
3048	Unicorn-31752.exe
2512	Unicorn-23056.exe
2512	Unicorn-23056.exe
2832	Unicorn-36019.exe
2832	Unicorn-36019.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4080	3684	WerFault.exe	211
4144	4256	WerFault.exe	303

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41109.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2692	63acff21c90be4591ab271cfd4043d50N.exe
2532	Unicorn-8011.exe
2728	Unicorn-12453.exe
2892	Unicorn-62209.exe
2832	Unicorn-36019.exe
2628	Unicorn-53102.exe
2416	Unicorn-64799.exe
2968	Unicorn-25612.exe
2512	Unicorn-23056.exe
2976	Unicorn-19334.exe
2984	Unicorn-56880.exe
2880	Unicorn-32111.exe
1148	Unicorn-18077.exe
2636	Unicorn-32376.exe
2956	Unicorn-61519.exe
2284	Unicorn-23030.exe
3048	Unicorn-31752.exe
340	Unicorn-37372.exe
1972	Unicorn-61322.exe
2452	Unicorn-8208.exe
2332	Unicorn-65022.exe
564	Unicorn-31203.exe
1964	Unicorn-44218.exe
2044	Unicorn-40134.exe
2352	Unicorn-38088.exe
1124	Unicorn-62976.exe
640	Unicorn-31966.exe
2408	Unicorn-31701.exe
2704	Unicorn-14114.exe
2940	Unicorn-52215.exe
2764	Unicorn-9328.exe
2980	Unicorn-32349.exe
1908	Unicorn-64467.exe
2348	Unicorn-31965.exe
2960	Unicorn-35857.exe
2864	Unicorn-37341.exe
940	Unicorn-47555.exe
2516	Unicorn-25280.exe
2308	Unicorn-60383.exe
1904	Unicorn-16781.exe
1944	Unicorn-6906.exe
604	Unicorn-61151.exe
1272	Unicorn-36263.exe
1928	Unicorn-61706.exe
1156	Unicorn-13382.exe
976	Unicorn-27117.exe
956	Unicorn-32983.exe
1612	Unicorn-49070.exe
2180	Unicorn-36263.exe
896	Unicorn-56491.exe
2500	Unicorn-56791.exe
344	Unicorn-4275.exe
2096	Unicorn-23819.exe
2448	Unicorn-17301.exe
2904	Unicorn-42303.exe
2336	Unicorn-16720.exe
2644	Unicorn-2303.exe
2840	Unicorn-6942.exe
1976	Unicorn-55204.exe
2856	Unicorn-6750.exe
2148	Unicorn-42952.exe
2844	Unicorn-64259.exe
2088	Unicorn-19600.exe
2208	Unicorn-51103.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2532	2692	63acff21c90be4591ab271cfd4043d50N.exe	30
PID 2692 wrote to memory of 2532	2692	63acff21c90be4591ab271cfd4043d50N.exe	30
PID 2692 wrote to memory of 2532	2692	63acff21c90be4591ab271cfd4043d50N.exe	30
PID 2692 wrote to memory of 2532	2692	63acff21c90be4591ab271cfd4043d50N.exe	30
PID 2532 wrote to memory of 2728	2532	Unicorn-8011.exe	31
PID 2532 wrote to memory of 2728	2532	Unicorn-8011.exe	31
PID 2532 wrote to memory of 2728	2532	Unicorn-8011.exe	31
PID 2532 wrote to memory of 2728	2532	Unicorn-8011.exe	31
PID 2692 wrote to memory of 2892	2692	63acff21c90be4591ab271cfd4043d50N.exe	32
PID 2692 wrote to memory of 2892	2692	63acff21c90be4591ab271cfd4043d50N.exe	32
PID 2692 wrote to memory of 2892	2692	63acff21c90be4591ab271cfd4043d50N.exe	32
PID 2692 wrote to memory of 2892	2692	63acff21c90be4591ab271cfd4043d50N.exe	32
PID 2728 wrote to memory of 2832	2728	Unicorn-12453.exe	33
PID 2728 wrote to memory of 2832	2728	Unicorn-12453.exe	33
PID 2728 wrote to memory of 2832	2728	Unicorn-12453.exe	33
PID 2728 wrote to memory of 2832	2728	Unicorn-12453.exe	33
PID 2532 wrote to memory of 2628	2532	Unicorn-8011.exe	34
PID 2532 wrote to memory of 2628	2532	Unicorn-8011.exe	34
PID 2532 wrote to memory of 2628	2532	Unicorn-8011.exe	34
PID 2532 wrote to memory of 2628	2532	Unicorn-8011.exe	34
PID 2892 wrote to memory of 2416	2892	Unicorn-62209.exe	35
PID 2892 wrote to memory of 2416	2892	Unicorn-62209.exe	35
PID 2892 wrote to memory of 2416	2892	Unicorn-62209.exe	35
PID 2892 wrote to memory of 2416	2892	Unicorn-62209.exe	35
PID 2692 wrote to memory of 2968	2692	63acff21c90be4591ab271cfd4043d50N.exe	36
PID 2692 wrote to memory of 2968	2692	63acff21c90be4591ab271cfd4043d50N.exe	36
PID 2692 wrote to memory of 2968	2692	63acff21c90be4591ab271cfd4043d50N.exe	36
PID 2692 wrote to memory of 2968	2692	63acff21c90be4591ab271cfd4043d50N.exe	36
PID 2832 wrote to memory of 2512	2832	Unicorn-36019.exe	37
PID 2832 wrote to memory of 2512	2832	Unicorn-36019.exe	37
PID 2832 wrote to memory of 2512	2832	Unicorn-36019.exe	37
PID 2832 wrote to memory of 2512	2832	Unicorn-36019.exe	37
PID 2728 wrote to memory of 2976	2728	Unicorn-12453.exe	38
PID 2728 wrote to memory of 2976	2728	Unicorn-12453.exe	38
PID 2728 wrote to memory of 2976	2728	Unicorn-12453.exe	38
PID 2728 wrote to memory of 2976	2728	Unicorn-12453.exe	38
PID 2416 wrote to memory of 2984	2416	Unicorn-64799.exe	39
PID 2416 wrote to memory of 2984	2416	Unicorn-64799.exe	39
PID 2416 wrote to memory of 2984	2416	Unicorn-64799.exe	39
PID 2416 wrote to memory of 2984	2416	Unicorn-64799.exe	39
PID 2692 wrote to memory of 2880	2692	63acff21c90be4591ab271cfd4043d50N.exe	41
PID 2692 wrote to memory of 2880	2692	63acff21c90be4591ab271cfd4043d50N.exe	41
PID 2692 wrote to memory of 2880	2692	63acff21c90be4591ab271cfd4043d50N.exe	41
PID 2692 wrote to memory of 2880	2692	63acff21c90be4591ab271cfd4043d50N.exe	41
PID 2628 wrote to memory of 2636	2628	Unicorn-53102.exe	42
PID 2628 wrote to memory of 2636	2628	Unicorn-53102.exe	42
PID 2628 wrote to memory of 2636	2628	Unicorn-53102.exe	42
PID 2628 wrote to memory of 2636	2628	Unicorn-53102.exe	42
PID 2892 wrote to memory of 2956	2892	Unicorn-62209.exe	40
PID 2892 wrote to memory of 2956	2892	Unicorn-62209.exe	40
PID 2892 wrote to memory of 2956	2892	Unicorn-62209.exe	40
PID 2892 wrote to memory of 2956	2892	Unicorn-62209.exe	40
PID 2532 wrote to memory of 1148	2532	Unicorn-8011.exe	43
PID 2532 wrote to memory of 1148	2532	Unicorn-8011.exe	43
PID 2532 wrote to memory of 1148	2532	Unicorn-8011.exe	43
PID 2532 wrote to memory of 1148	2532	Unicorn-8011.exe	43
PID 2512 wrote to memory of 2284	2512	Unicorn-23056.exe	44
PID 2512 wrote to memory of 2284	2512	Unicorn-23056.exe	44
PID 2512 wrote to memory of 2284	2512	Unicorn-23056.exe	44
PID 2512 wrote to memory of 2284	2512	Unicorn-23056.exe	44
PID 2832 wrote to memory of 3048	2832	Unicorn-36019.exe	45
PID 2832 wrote to memory of 3048	2832	Unicorn-36019.exe	45
PID 2832 wrote to memory of 3048	2832	Unicorn-36019.exe	45
PID 2832 wrote to memory of 3048	2832	Unicorn-36019.exe	45

C:\Users\Admin\AppData\Local\Temp\63acff21c90be4591ab271cfd4043d50N.exe
"C:\Users\Admin\AppData\Local\Temp\63acff21c90be4591ab271cfd4043d50N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36019.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14114.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64711.exe
        9⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        10⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        10⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49429.exe
        10⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        9⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
        9⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        9⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        9⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        8⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30366.exe
        8⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        8⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        8⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
        8⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe
        8⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46038.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        7⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
        7⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
        7⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19600.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        8⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        8⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        8⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34788.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        7⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59613.exe
        7⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        7⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14154.exe
        6⤵
        Executes dropped EXE
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58754.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        7⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37498.exe
        6⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52215.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55204.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
        8⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exe
        8⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        8⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exe
        7⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55997.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45689.exe
        7⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        7⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        7⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        7⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        6⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40173.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        5⤵
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47555.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        7⤵
        
        PID:280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        8⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        8⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        8⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        8⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        7⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        7⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        7⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe
        6⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15703.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40242.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 188
        8⤵
        Program crash
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        7⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        6⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48676.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15649.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35525.exe
        6⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25157.exe
        7⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        6⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
        5⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8530.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37498.exe
        5⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
        6⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6740.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39422.exe
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
        5⤵
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        5⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7021.exe
        6⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
      4⤵
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37239.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47138.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        5⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
      4⤵
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
      4⤵
      PID:6408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53102.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
        7⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        8⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        8⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        8⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        7⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        7⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        6⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59613.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26783.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        6⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        6⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26421.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53362.exe
        6⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44141.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        7⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        7⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        5⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10657.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63092.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        5⤵
        
        PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
      4⤵
      Executes dropped EXE
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
        6⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        7⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25451.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        7⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47041.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
        5⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58375.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        5⤵
        
        PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
        5⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        5⤵
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
      4⤵
      PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
      4⤵
      PID:6552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35857.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53197.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
      4⤵
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14223.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
      4⤵
      PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
      4⤵
      PID:6528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23819.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
        5⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
      4⤵
      PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
      4⤵
      PID:6784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17301.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8608.exe
      4⤵
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44257.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
      4⤵
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
      4⤵
      PID:6696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exe
      4⤵
      PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20497.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      4⤵
      PID:5832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
    3⤵
    PID:2120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
    3⤵
    PID:4020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31737.exe
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43825.exe
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
    3⤵
    PID:6580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64799.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60186.exe
        8⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        9⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        9⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        9⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        8⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        8⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22261.exe
        8⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4716.exe
        7⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
        8⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        8⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        8⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exe
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24315.exe
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        6⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
        7⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        8⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        8⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51622.exe
        8⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
        7⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        7⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17875.exe
        6⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10657.exe
        7⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63092.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15649.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31965.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        6⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45381.exe
        7⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        7⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        6⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61862.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52361.exe
        6⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51103.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56024.exe
        5⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
        5⤵
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5277.exe
        5⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        6⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20677.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46846.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        5⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        6⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47571.exe
        5⤵
        
        PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37341.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1893.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13454.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21645.exe
        5⤵
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33645.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
      4⤵
      PID:296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exe
      4⤵
      PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40134.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55391.exe
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32169.exe
        7⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46038.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        6⤵
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        6⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
        5⤵
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
        5⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49261.exe
      4⤵
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59962.exe
        5⤵
        
        PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59776.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61342.exe
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
      4⤵
      PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45344.exe
      4⤵
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47138.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
      4⤵
      PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18253.exe
      4⤵
      PID:5316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32983.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
      4⤵
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47851.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18775.exe
    3⤵
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
      4⤵
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22314.exe
      4⤵
      PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12297.exe
    3⤵
    PID:2788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe
    3⤵
    PID:3108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28873.exe
    3⤵
    PID:5720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25612.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25612.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
        5⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24556.exe
        6⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15448.exe
        7⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
        8⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        8⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        7⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51423.exe
        7⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        7⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        6⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
        5⤵
        
        PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
      4⤵
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32553.exe
        5⤵
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
      4⤵
      PID:6656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25280.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
      4⤵
      PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59613.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
      4⤵
      PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7954.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
    3⤵
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
    3⤵
    PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exe
    3⤵
    PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
    3⤵
    PID:6544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32111.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32111.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        5⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16631.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33034.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22178.exe
      4⤵
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26090.exe
      4⤵
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
      4⤵
      PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49070.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe
      4⤵
      PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30554.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46846.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
      4⤵
      PID:6792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
    3⤵
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
      4⤵
      PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
      4⤵
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
      4⤵
      PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
      4⤵
      PID:6560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37498.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
    3⤵
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31203.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31203.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
      4⤵
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8393.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10539.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
      4⤵
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
      4⤵
      PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38135.exe
    3⤵
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
      4⤵
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
      4⤵
      PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
    3⤵
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
    3⤵
    PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
    3⤵
    PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58193.exe
    3⤵
    PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43949.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40012.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35835.exe
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
    3⤵
    PID:3684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 188
      4⤵
      Program crash
      PID:4080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24315.exe
    3⤵
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
    3⤵
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
    3⤵
    PID:5884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49601.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49601.exe
  2⤵
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56289.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
    3⤵
    PID:4608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
    3⤵
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62225.exe
    3⤵
    PID:5852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
  2⤵
  PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
    3⤵
    PID:3736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43198.exe
    3⤵
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
    3⤵
    PID:5696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29452.exe
    3⤵
    PID:7052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
  2⤵
  PID:4760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61206.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61206.exe
  2⤵
  PID:5272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
  2⤵
  PID:6596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe

Filesize
468KB

MD5
12202131a02b793d7bb5db7c1ab593f8

SHA1
27d6138d79df1f9083c6999944f0014431ccbd1b

SHA256
69d0c9a0ff9c08a34b7d9fd8baeb8f38ce9f1dc693fe16a42637d5c8924d7980

SHA512
327d5890d2c4ec201df6a1b6bb6cae09d1a3a5afd149d4889abe6d5e8218293df5eb19f7e5f1c15fd99938be0ab9b9b9e37f5ed2831e34824c677bfe25c93e59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe

Filesize
468KB

MD5
ba7baddb242070769f68be395c87060c

SHA1
b8c7a92debe98e3b6a6f52ce6eff28b0d2dea8e2

SHA256
54c52a98f092f895190b938182011e30d0985a305ed26ae1f69b38134491f823

SHA512
93f6529107f8f12dfe35d9fcebff911016f0e3235a6238c9396735aff073bf382dc41434bbb33359238faa5d942504f460d0347faeae3871f4e79485c214f254

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32111.exe

Filesize
468KB

MD5
3b3bb6df89e9a50082fe243131a657d7

SHA1
85bc984d3291031422728e345adbdb9cc1e5c71c

SHA256
3b9f4b1dbf89554fcaa9e92226ab2e4e22c15d75713eedd10b09a346999494d7

SHA512
9b89792804a5508cecc5238075705ea096a694b3aafe66179fb07edef3c51de17fd79c84c50c9d278f421f605ad0791ae8e24b007862889391c5ad418d93bf52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe

Filesize
468KB

MD5
387ffedf58cae5b4421250a234b45e2c

SHA1
7ccc01cfcb1c17302edac50aacf5b6a6de75893a

SHA256
b3dcd579d103903ae5a0fa0015fae80793ca9dc06530a5125326133cd62e1e5b

SHA512
086f6db081468e9b4a171c88305fc76c00c7875c10d997b5d580cadcf04d3cf229d49fe7e40e5599624a5fc0464e6292469cf387edf773868e550f9b91e2aa99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36019.exe

Filesize
468KB

MD5
201302f9655c7fc4c68456cdde370569

SHA1
a397ecb29740ba2bd5162e9f477cc27a701f2379

SHA256
836f6d687931c2240ef1119a593bc1d2f40f74168d289c0815a1fd0b7d397581

SHA512
37fb1e2a774f31a3fe2ffc3f118e33705b377581b2755a010c97cfccef2f61dadc0c6e977a165f37f48f50e2e9f24d8c5d2b8f42b8012f62609cf1bb33a4341d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe

Filesize
468KB

MD5
14ff932d7a66ab7e769de77fd676552a

SHA1
eeed2ee6f2724d973b179f9af9a718d53bf81cb5

SHA256
12c7eed52dde31d158b7dbc64e89dfb31fcc150160ec6703742133a88bf7c380

SHA512
c423b5a3facab1f5e05404cdf1e6125d665f3dabfa3c2944918cb9adb3c161bad28dba50c1cf5df73776714ced68d2dc72ab206b302f5e70808fdbfa378de5fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe

Filesize
468KB

MD5
763146849c7d79985d4d6b1cd22d17dc

SHA1
50b70445287b63196310b6fa85fea2b06afea953

SHA256
37c468fcd9219d50d875bf01a48c9467f8efcfe6a6d94eead4757ef8d80d33ee

SHA512
fb13fe6f95f442ddc1f54e20d3519198355ed8627b5a4afe33da1683d9f51bf89d1c9b8f62eaac67f3b3f00ec42b1ef4336d21e3cda61e605375f4e7c319679a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe

Filesize
468KB

MD5
a181dcc2b79edbdb4bcb8b8f627a6342

SHA1
33ab91f3da1f48950233e9365d4515fbb375fe08

SHA256
18ec5d52b8c173ed0301846e40b07b3fc1845e41495a045885572bc2bb066c93

SHA512
fb22e0a21dda7fbee590c0c87644967a930717b86194d2880eb24f609f9da0211ce2f52d1f6df66b89be6ddb8377a587c502fc2cf3e87ae051d23876f2eab018

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe

Filesize
468KB

MD5
c1cfa66fd920f5563445b541fc155ce2

SHA1
a365e50cfa4229adf92350520d7c56d47b15729f

SHA256
991d696aeb1ba8ea98ab4a87d20ea0f534d5b11b15ace0206dd09e1b45d1c592

SHA512
27f2619763bdd31b3edd03b28fff705a7752f8b6cae11ba5f8e303a018378b93fe86606c6e4a8c97b343c739a218205bc7dd2889e1b204211f07a9052bf80020

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe

Filesize
468KB

MD5
2bf4510d1d7287d85653e6919111ad10

SHA1
1254364233fe30eef21f997f2f04474a6b2ebc90

SHA256
a6f748db988127bb549b17e5d09adf8f3887bec1ed3209e77768682b4a70dfbd

SHA512
f86bc80ebff0928f9c07c72e66316d4c4a059896ffc99868b8eac349274ccf2bb85e6b3eec25290d8e5217bcd5243cf9decf62800086f1055e3e5fb8f907a9e8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe

Filesize
468KB

MD5
45d78a8a29bbf5ed94d526106e2f16cc

SHA1
3895ecad386ff8625480d2be26bed9a78552e491

SHA256
073b10ab08bfbbe1a17573c352dffbfd49d0e524e365b32a3465e7feb02b854c

SHA512
2614e26f524c246bf99e5e231e2e7f968099dc8d5911428d126717c8b6da4da719340b6907442290bc3996654a3d797422cec809bbeaabf4cc8c906f782b6877

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe

Filesize
468KB

MD5
b3cc1fc421bf1dfd2e8e5c8f91674796

SHA1
856a0fb360e9e6c5161d1b299c8e0c0f1f5b50dc

SHA256
e1b1a4fba6c1bdf6cd6c1247cec3c50a5a6f34c47bc87f766cddd7f26ad0e41f

SHA512
04813da4c4c994a31aa6ff097f4460fb85fcc86982a555c38f5ff3251271ac9cd01492d73b68bbb0768ef14b56d7c347d35f9a6737477715d86206cce75a05f5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25612.exe

Filesize
468KB

MD5
70e333a531a47c60e9fec2e8abd8cd45

SHA1
028315fb9ee473fcf0f62df141bd48ad15fce6d7

SHA256
d27d86425c2ab5229cbe86c6da52cbbc663bdbebf84a59a27a7b6412d112fc2f

SHA512
f138d1383b44afa49c43ed1d7e35f614c006134409da0358a0d16e4a91dcbbf903715b4e19c2bbd6a6fb8d5d51db33d6db31280089bffa615ea9f86df7e2fe88

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe

Filesize
468KB

MD5
af15580a555a9961113661f76df0ef87

SHA1
a67903c76a9e205747ff562de1cd04793f6b5703

SHA256
26f8024eb1428faacb7f8e86eab062e203d589d3f93106ff87e901de7fe498da

SHA512
3536962c417127aac9685d7ea87391ed77d29c4bfb4a2c4f161d0502d62388f23e2db6fee9b4b99f6522d758e7e3db27c1ac9179968521a5359355c9d2c537ca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53102.exe

Filesize
468KB

MD5
df226d826ca2cfb8c5de7570e2bbfcd5

SHA1
73d9db8d7ec09b0c36422721b66a68d0dbd7763a

SHA256
6da82e59cd047f3a37646ab34e24df8175c85e93f21ba8f5b57c985eaec015c7

SHA512
8553ca6de63180f83a3695a38c4fba0b77e2b72d3e6c742404f8965ae828548585bd97e9f46eaffc8811dd4653fbb1b5b76e5276a929f7d9da0f3fd940e28693

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe

Filesize
468KB

MD5
72305b16cf478251a218512bda5c9ce1

SHA1
f741d97248e7932365b56e7c40bef93e69142295

SHA256
ddb3f321f18175f174fa1c9f76ee7dd6219c9c36809a74e92fcb8ae490dc50a3

SHA512
3faa99aed2d6ac03d281b92175a53b1955bff5b4551d590ba04b518d5190ab1feab0a958e2606962791d48692d47e490932cd6140099aa238cc8a474dde09944

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe

Filesize
468KB

MD5
375b7b85fecda2aea06cecf5b340986d

SHA1
0b70e6c0915a9e929b6dd46a107088a62bed32c7

SHA256
eb52872278e3a83849bb7cacd6912c542f59c92b96f12d7d3384473c01d522f1

SHA512
7cf66c808e4aa778334c4e19b6e1786d19b71f2b57840a1cbd0f3f21b3a777154559769fa4bab40fe596b2a6bc0584587cc92796dd9b5ab4fd61637d5baafc6e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64799.exe

Filesize
468KB

MD5
c209f3c785634befc1601396d217df7b

SHA1
7b067a013a467041cf8e82a41d0da75c2f28ecae

SHA256
8460cb183044dc58cf1318b082ca2266458f275a43c91ef4cb9ef1dd2a2d78f6

SHA512
ea2c76e81c095158cd04dac801ee6230227966049b39e92c2f7e3de1cb9537f48eab03a965c42b7d53d407dcac0c8b0e5ccc7dcbcab828462a56699e87e52b3c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe

Filesize
468KB

MD5
689b062715047a1c38d4b7775b55405e

SHA1
9eee36cd738ea2052091d017040bd721fb0e3a5b

SHA256
4960f6b75209919f13c292457ce41bd21c05064ba9e9370d4d684ca775acd5f7

SHA512
09eafc59e5036af789cda310f6ed75815342daaf26ef3e54d165f259274e3df5ced9cc8ae562b15d49a83ce9d3e08ec41a67cf85d6d6609ae8f0cb11b3cac1be

Download Submit
memory/340-378-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/340-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/340-377-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/564-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/640-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-380-0x0000000000570000-0x00000000005E5000-memory.dmp

Filesize
468KB

Download
memory/1972-385-0x0000000000570000-0x00000000005E5000-memory.dmp

Filesize
468KB

Download
memory/2044-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-335-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2284-336-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2284-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-237-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2416-120-0x00000000033F0000-0x0000000003465000-memory.dmp

Filesize
468KB

Download
memory/2416-238-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2416-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-409-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2452-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-404-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2496-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-187-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2512-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-353-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2512-188-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2512-354-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2516-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-25-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2532-266-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2532-62-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2532-168-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2532-278-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2532-169-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2628-314-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2628-154-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2628-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-142-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2628-310-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2636-303-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2636-293-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2692-153-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2692-292-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2692-11-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2692-36-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2692-298-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2692-151-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2692-10-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2692-408-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2692-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-252-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2728-261-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2728-49-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2764-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-363-0x0000000000720000-0x0000000000795000-memory.dmp

Filesize
468KB

Download
memory/2832-362-0x0000000000720000-0x0000000000795000-memory.dmp

Filesize
468KB

Download
memory/2832-199-0x0000000000720000-0x0000000000795000-memory.dmp

Filesize
468KB

Download
memory/2832-200-0x0000000000720000-0x0000000000795000-memory.dmp

Filesize
468KB

Download
memory/2880-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-264-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2892-136-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2892-307-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2892-75-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2892-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-152-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2892-306-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2940-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-296-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2956-295-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2968-392-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2968-217-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2968-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-215-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2976-249-0x0000000000680000-0x00000000006F5000-memory.dmp

Filesize
468KB

Download
memory/2976-248-0x0000000000680000-0x00000000006F5000-memory.dmp

Filesize
468KB

Download
memory/2976-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-402-0x0000000002410000-0x0000000002485000-memory.dmp

Filesize
468KB

Download
memory/2984-400-0x0000000002410000-0x0000000002485000-memory.dmp

Filesize
468KB

Download
memory/2984-229-0x0000000002410000-0x0000000002485000-memory.dmp

Filesize
468KB

Download
memory/2984-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-230-0x0000000002410000-0x0000000002485000-memory.dmp

Filesize
468KB

Download
memory/3048-350-0x0000000000750000-0x00000000007C5000-memory.dmp

Filesize
468KB

Download
memory/3048-351-0x0000000000750000-0x00000000007C5000-memory.dmp

Filesize
468KB

Download
memory/3048-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download