df8ec18b322eed429602a44f892ff11c3495d80bc02839f24211f23da5ccaadc

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f056a6ad37dd28a838df26f9aaae68b0N.exe
Size

468KB
MD5

f056a6ad37dd28a838df26f9aaae68b0
SHA1

a623cf9908a3695f319023237c6447eb9dd57090
SHA256

df8ec18b322eed429602a44f892ff11c3495d80bc02839f24211f23da5ccaadc
SHA512

3f527ffb9feda4027009a9894d339f2cf55df679701edf85ae0ba3fb564e2a16b03052a4380f339832785687fa0c20716bde6b458dc0430f3c659477db746541
SSDEEP

3072:/I+povIwU35/tbYAPgrvOf8/Uj9fNIXXTmHoHS6cig84CoEuozlm:/I8oIJ/tLPqvOfD2LeighfEuo

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2340	Unicorn-14041.exe
2928	Unicorn-40252.exe
2904	Unicorn-17140.exe
2872	Unicorn-60201.exe
2720	Unicorn-60101.exe
2728	Unicorn-17799.exe
340	Unicorn-36827.exe
828	Unicorn-19252.exe
2428	Unicorn-8130.exe
948	Unicorn-21774.exe
2524	Unicorn-40802.exe
3012	Unicorn-64752.exe
2180	Unicorn-44232.exe
2268	Unicorn-19370.exe
892	Unicorn-38110.exe
1068	Unicorn-45640.exe
1812	Unicorn-33942.exe
2280	Unicorn-49532.exe
2256	Unicorn-4114.exe
904	Unicorn-32794.exe
1508	Unicorn-49515.exe
1944	Unicorn-37171.exe
2612	Unicorn-53507.exe
1784	Unicorn-33641.exe
1716	Unicorn-53507.exe
1900	Unicorn-38355.exe
1536	Unicorn-47285.exe
1136	Unicorn-63356.exe
3068	Unicorn-51924.exe
1988	Unicorn-45147.exe
2032	Unicorn-15743.exe
2124	Unicorn-57975.exe
1512	Unicorn-31232.exe
872	Unicorn-37363.exe
1592	Unicorn-24295.exe
2816	Unicorn-21603.exe
2908	Unicorn-46662.exe
2884	Unicorn-39885.exe
2332	Unicorn-52692.exe
2644	Unicorn-7020.exe
472	Unicorn-53818.exe
2468	Unicorn-23933.exe
2712	Unicorn-44088.exe
1960	Unicorn-13133.exe
1244	Unicorn-3382.exe
2028	Unicorn-14317.exe
2556	Unicorn-23248.exe
2344	Unicorn-40138.exe
2184	Unicorn-62718.exe
2744	Unicorn-41841.exe
2328	Unicorn-62526.exe
2072	Unicorn-9796.exe
2476	Unicorn-496.exe
2492	Unicorn-17031.exe
2472	Unicorn-25962.exe
604	Unicorn-44991.exe
2236	Unicorn-11571.exe
2568	Unicorn-11571.exe
1620	Unicorn-46382.exe
1348	Unicorn-2588.exe
1360	Unicorn-33314.exe
1548	Unicorn-47513.exe
912	Unicorn-24299.exe
1932	Unicorn-38598.exe

Loads dropped DLL 64 IoCs

pid	Process
2248	f056a6ad37dd28a838df26f9aaae68b0N.exe
2248	f056a6ad37dd28a838df26f9aaae68b0N.exe
2248	f056a6ad37dd28a838df26f9aaae68b0N.exe
2340	Unicorn-14041.exe
2248	f056a6ad37dd28a838df26f9aaae68b0N.exe
2340	Unicorn-14041.exe
2928	Unicorn-40252.exe
2928	Unicorn-40252.exe
2248	f056a6ad37dd28a838df26f9aaae68b0N.exe
2248	f056a6ad37dd28a838df26f9aaae68b0N.exe
2904	Unicorn-17140.exe
2340	Unicorn-14041.exe
2904	Unicorn-17140.exe
2340	Unicorn-14041.exe
2872	Unicorn-60201.exe
2872	Unicorn-60201.exe
2928	Unicorn-40252.exe
2928	Unicorn-40252.exe
2728	Unicorn-17799.exe
2728	Unicorn-17799.exe
2904	Unicorn-17140.exe
2904	Unicorn-17140.exe
2720	Unicorn-60101.exe
2340	Unicorn-14041.exe
2720	Unicorn-60101.exe
2340	Unicorn-14041.exe
2248	f056a6ad37dd28a838df26f9aaae68b0N.exe
340	Unicorn-36827.exe
340	Unicorn-36827.exe
2248	f056a6ad37dd28a838df26f9aaae68b0N.exe
828	Unicorn-19252.exe
2872	Unicorn-60201.exe
828	Unicorn-19252.exe
2872	Unicorn-60201.exe
2428	Unicorn-8130.exe
2428	Unicorn-8130.exe
2524	Unicorn-40802.exe
2524	Unicorn-40802.exe
2928	Unicorn-40252.exe
2928	Unicorn-40252.exe
2904	Unicorn-17140.exe
2904	Unicorn-17140.exe
3012	Unicorn-64752.exe
3012	Unicorn-64752.exe
2720	Unicorn-60101.exe
2268	Unicorn-19370.exe
2180	Unicorn-44232.exe
2720	Unicorn-60101.exe
2268	Unicorn-19370.exe
2180	Unicorn-44232.exe
2248	f056a6ad37dd28a838df26f9aaae68b0N.exe
2248	f056a6ad37dd28a838df26f9aaae68b0N.exe
948	Unicorn-21774.exe
948	Unicorn-21774.exe
2340	Unicorn-14041.exe
2340	Unicorn-14041.exe
2728	Unicorn-17799.exe
2728	Unicorn-17799.exe
892	Unicorn-38110.exe
892	Unicorn-38110.exe
340	Unicorn-36827.exe
340	Unicorn-36827.exe
1812	Unicorn-33942.exe
1812	Unicorn-33942.exe

Program crash 16 IoCs

pid	pid_target	Process	procid_target
2984	872	WerFault.exe	61
424	472	WerFault.exe	69
1692	2392	WerFault.exe	95
2092	1560	WerFault.exe	97
3432	2184	WerFault.exe	78
3500	2280	WerFault.exe	46
4028	2428	WerFault.exe	37
3684	1592	WerFault.exe	63
3876	2124	WerFault.exe	60
4284	2644	WerFault.exe	68
4860	2908	WerFault.exe	65
4844	1512	WerFault.exe	62
4876	2492	WerFault.exe	83
5940	1068	WerFault.exe	44
5924	852	WerFault.exe	123
5752	2072	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38110.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2248	f056a6ad37dd28a838df26f9aaae68b0N.exe
2340	Unicorn-14041.exe
2928	Unicorn-40252.exe
2904	Unicorn-17140.exe
2872	Unicorn-60201.exe
2720	Unicorn-60101.exe
2728	Unicorn-17799.exe
340	Unicorn-36827.exe
828	Unicorn-19252.exe
2428	Unicorn-8130.exe
2524	Unicorn-40802.exe
3012	Unicorn-64752.exe
948	Unicorn-21774.exe
2268	Unicorn-19370.exe
2180	Unicorn-44232.exe
892	Unicorn-38110.exe
1812	Unicorn-33942.exe
1068	Unicorn-45640.exe
2280	Unicorn-49532.exe
904	Unicorn-32794.exe
2256	Unicorn-4114.exe
1508	Unicorn-49515.exe
1944	Unicorn-37171.exe
1784	Unicorn-33641.exe
1900	Unicorn-38355.exe
2612	Unicorn-53507.exe
1536	Unicorn-47285.exe
1136	Unicorn-63356.exe
3068	Unicorn-51924.exe
1716	Unicorn-53507.exe
1988	Unicorn-45147.exe
2032	Unicorn-15743.exe
1512	Unicorn-31232.exe
2124	Unicorn-57975.exe
872	Unicorn-37363.exe
2816	Unicorn-21603.exe
1592	Unicorn-24295.exe
2884	Unicorn-39885.exe
2908	Unicorn-46662.exe
2332	Unicorn-52692.exe
472	Unicorn-53818.exe
2644	Unicorn-7020.exe
2468	Unicorn-23933.exe
2712	Unicorn-44088.exe
1244	Unicorn-3382.exe
2028	Unicorn-14317.exe
1960	Unicorn-13133.exe
2556	Unicorn-23248.exe
2184	Unicorn-62718.exe
2344	Unicorn-40138.exe
2328	Unicorn-62526.exe
2744	Unicorn-41841.exe
2072	Unicorn-9796.exe
604	Unicorn-44991.exe
2476	Unicorn-496.exe
2492	Unicorn-17031.exe
2472	Unicorn-25962.exe
2568	Unicorn-11571.exe
1360	Unicorn-33314.exe
1620	Unicorn-46382.exe
2236	Unicorn-11571.exe
1348	Unicorn-2588.exe
1548	Unicorn-47513.exe
912	Unicorn-24299.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2340	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	29
PID 2248 wrote to memory of 2340	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	29
PID 2248 wrote to memory of 2340	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	29
PID 2248 wrote to memory of 2340	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	29
PID 2248 wrote to memory of 2928	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	30
PID 2248 wrote to memory of 2928	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	30
PID 2248 wrote to memory of 2928	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	30
PID 2248 wrote to memory of 2928	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	30
PID 2340 wrote to memory of 2904	2340	Unicorn-14041.exe	31
PID 2340 wrote to memory of 2904	2340	Unicorn-14041.exe	31
PID 2340 wrote to memory of 2904	2340	Unicorn-14041.exe	31
PID 2340 wrote to memory of 2904	2340	Unicorn-14041.exe	31
PID 2928 wrote to memory of 2872	2928	Unicorn-40252.exe	32
PID 2928 wrote to memory of 2872	2928	Unicorn-40252.exe	32
PID 2928 wrote to memory of 2872	2928	Unicorn-40252.exe	32
PID 2928 wrote to memory of 2872	2928	Unicorn-40252.exe	32
PID 2248 wrote to memory of 2720	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	33
PID 2248 wrote to memory of 2720	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	33
PID 2248 wrote to memory of 2720	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	33
PID 2248 wrote to memory of 2720	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	33
PID 2904 wrote to memory of 2728	2904	Unicorn-17140.exe	34
PID 2904 wrote to memory of 2728	2904	Unicorn-17140.exe	34
PID 2904 wrote to memory of 2728	2904	Unicorn-17140.exe	34
PID 2904 wrote to memory of 2728	2904	Unicorn-17140.exe	34
PID 2340 wrote to memory of 340	2340	Unicorn-14041.exe	35
PID 2340 wrote to memory of 340	2340	Unicorn-14041.exe	35
PID 2340 wrote to memory of 340	2340	Unicorn-14041.exe	35
PID 2340 wrote to memory of 340	2340	Unicorn-14041.exe	35
PID 2872 wrote to memory of 828	2872	Unicorn-60201.exe	36
PID 2872 wrote to memory of 828	2872	Unicorn-60201.exe	36
PID 2872 wrote to memory of 828	2872	Unicorn-60201.exe	36
PID 2872 wrote to memory of 828	2872	Unicorn-60201.exe	36
PID 2928 wrote to memory of 2428	2928	Unicorn-40252.exe	37
PID 2928 wrote to memory of 2428	2928	Unicorn-40252.exe	37
PID 2928 wrote to memory of 2428	2928	Unicorn-40252.exe	37
PID 2928 wrote to memory of 2428	2928	Unicorn-40252.exe	37
PID 2728 wrote to memory of 948	2728	Unicorn-17799.exe	38
PID 2728 wrote to memory of 948	2728	Unicorn-17799.exe	38
PID 2728 wrote to memory of 948	2728	Unicorn-17799.exe	38
PID 2728 wrote to memory of 948	2728	Unicorn-17799.exe	38
PID 2904 wrote to memory of 2524	2904	Unicorn-17140.exe	39
PID 2904 wrote to memory of 2524	2904	Unicorn-17140.exe	39
PID 2904 wrote to memory of 2524	2904	Unicorn-17140.exe	39
PID 2904 wrote to memory of 2524	2904	Unicorn-17140.exe	39
PID 2720 wrote to memory of 3012	2720	Unicorn-60101.exe	40
PID 2720 wrote to memory of 3012	2720	Unicorn-60101.exe	40
PID 2720 wrote to memory of 3012	2720	Unicorn-60101.exe	40
PID 2720 wrote to memory of 3012	2720	Unicorn-60101.exe	40
PID 2340 wrote to memory of 2180	2340	Unicorn-14041.exe	41
PID 2340 wrote to memory of 2180	2340	Unicorn-14041.exe	41
PID 2340 wrote to memory of 2180	2340	Unicorn-14041.exe	41
PID 2340 wrote to memory of 2180	2340	Unicorn-14041.exe	41
PID 340 wrote to memory of 892	340	Unicorn-36827.exe	43
PID 340 wrote to memory of 892	340	Unicorn-36827.exe	43
PID 340 wrote to memory of 892	340	Unicorn-36827.exe	43
PID 340 wrote to memory of 892	340	Unicorn-36827.exe	43
PID 2248 wrote to memory of 2268	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	42
PID 2248 wrote to memory of 2268	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	42
PID 2248 wrote to memory of 2268	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	42
PID 2248 wrote to memory of 2268	2248	f056a6ad37dd28a838df26f9aaae68b0N.exe	42
PID 828 wrote to memory of 1068	828	Unicorn-19252.exe	44
PID 828 wrote to memory of 1068	828	Unicorn-19252.exe	44
PID 828 wrote to memory of 1068	828	Unicorn-19252.exe	44
PID 828 wrote to memory of 1068	828	Unicorn-19252.exe	44

C:\Users\Admin\AppData\Local\Temp\f056a6ad37dd28a838df26f9aaae68b0N.exe
"C:\Users\Admin\AppData\Local\Temp\f056a6ad37dd28a838df26f9aaae68b0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17140.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21774.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47285.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63761.exe
        7⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25568.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3958.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33589.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        6⤵
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54132.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-440.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34286.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7518.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24299.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
        6⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30263.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54492.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        7⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        6⤵
        
        PID:708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23279.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57239.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6778.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9293.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4114.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36922.exe
        8⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        8⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6853.exe
        8⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        8⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41285.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        7⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29325.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        7⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44991.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        7⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46704.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13860.exe
        7⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        6⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22666.exe
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
        7⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12906.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52692.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        6⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10854.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43062.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe
        5⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
        6⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29889.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        5⤵
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        6⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe
        5⤵
        
        PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63372.exe
        5⤵
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42816.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15706.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21047.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17327.exe
      4⤵
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33985.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22666.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54456.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65030.exe
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe
      4⤵
      PID:5620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45147.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        7⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        7⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5195.exe
        7⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53393.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65536.exe
        6⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46713.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        6⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        7⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        7⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        7⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exe
        6⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12177.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64572.exe
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        5⤵
        
        PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61862.exe
        5⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12177.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64572.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16837.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51706.exe
      4⤵
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9377.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42544.exe
      4⤵
      PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4898.exe
      4⤵
      PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        5⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35194.exe
        5⤵
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
        5⤵
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
      4⤵
      PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
      4⤵
      PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6248.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25478.exe
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
      4⤵
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        5⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20306.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18520.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        5⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2686.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34213.exe
        5⤵
        
        PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3958.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14317.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5728.exe
      4⤵
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
      4⤵
      PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exe
    3⤵
    PID:2420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
    3⤵
    PID:4684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
    3⤵
    PID:5660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40252.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40252.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19252.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37363.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 240
        7⤵
        Program crash
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        7⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        7⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 220
        7⤵
        Program crash
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49541.exe
        6⤵
        
        PID:4260
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 240
        6⤵
        Program crash
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
        6⤵
        
        PID:4092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 240
        6⤵
        Program crash
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe
        5⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 216
        6⤵
        Program crash
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        5⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9377.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65102.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33942.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        7⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        7⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        6⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        7⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
        6⤵
        
        PID:4052
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 236
        6⤵
        Program crash
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        6⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        6⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        5⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        6⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32618.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        5⤵
        
        PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18244.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62718.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23928.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        7⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        6⤵
        
        PID:1160
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 240
        6⤵
        Program crash
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
        5⤵
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8551.exe
        5⤵
        
        PID:2360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 240
        5⤵
        Program crash
        
        PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe
        5⤵
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        5⤵
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12177.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64572.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        5⤵
        
        PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51178.exe
      4⤵
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10414.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        5⤵
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8379.exe
      4⤵
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39787.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44312.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
      4⤵
      PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8130.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49532.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21603.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe
        6⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30773.exe
        7⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        6⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51072.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64572.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        5⤵
        
        PID:1060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 236
        5⤵
        Program crash
        
        PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46662.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
        5⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57202.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60850.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 216
        5⤵
        Program crash
        
        PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64860.exe
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
      4⤵
      PID:3224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 240
      4⤵
      Program crash
      PID:4028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7020.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        5⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4109.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 236
        6⤵
        Program crash
        
        PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23138.exe
        5⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31897.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        5⤵
        
        PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        5⤵
        
        PID:3576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 240
        5⤵
        Program crash
        
        PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        5⤵
        
        PID:1972
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 236
        5⤵
        Program crash
        
        PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
      4⤵
      PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
      4⤵
      PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9377.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
      4⤵
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65102.exe
      4⤵
      PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
      4⤵
      PID:5868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 240
      4⤵
      Program crash
      PID:424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17031.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41582.exe
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60990.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
      4⤵
      PID:4356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 236
      4⤵
      Program crash
      PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
    3⤵
    PID:3968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57442.exe
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exe
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
    3⤵
    PID:5316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37171.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13133.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55401.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23937.exe
        7⤵
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12177.exe
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        7⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17876.exe
        6⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25381.exe
        7⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11814.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5195.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        7⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10694.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe
        6⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
        5⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59797.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        5⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7207.exe
        5⤵
        
        PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        5⤵
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
      4⤵
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14119.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe
      4⤵
      PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exe
      4⤵
      PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
      4⤵
      Executes dropped EXE
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60850.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29709.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36542.exe
      4⤵
      PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16719.exe
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
    3⤵
    PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe
      4⤵
      PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12718.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
    3⤵
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5454.exe
    3⤵
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40335.exe
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
    3⤵
    PID:5652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19370.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19370.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        5⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
        6⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        5⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15218.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
        5⤵
        
        PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
      4⤵
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62685.exe
        5⤵
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
      4⤵
      PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25568.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2222.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
      4⤵
      PID:5700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47513.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
      4⤵
      PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65536.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
      4⤵
      PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17029.exe
    3⤵
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36439.exe
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exe
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
    3⤵
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65102.exe
    3⤵
    PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
    3⤵
    PID:5936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38355.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38355.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
      4⤵
      PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
      4⤵
      PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
      4⤵
      PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exe
    3⤵
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19006.exe
    3⤵
    PID:288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40906.exe
    3⤵
    PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53281.exe
    3⤵
    PID:5500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23928.exe
    3⤵
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
    3⤵
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exe
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
    3⤵
    PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
    3⤵
    PID:5612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
  2⤵
  PID:1808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49990.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49990.exe
  2⤵
  PID:3276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
  2⤵
  PID:1528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63895.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63895.exe
  2⤵
  PID:4716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
  2⤵
  PID:5680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17140.exe

Filesize
468KB

MD5
e2b25292f1688fc240744a86b655be31

SHA1
3602cdba5ec0f0b9a30a8eea95d35638a5914778

SHA256
abb4f4989a4c90f5fdc57570c0928c88e66ab172d7d5d539404f0f2de1313c63

SHA512
605ee9a16f9ce38da5a412fbc4afcc3ebe503a95cec925f04763ed27cd35a9297ceff38e5170240a83395f05af28137d8623257158895dcf632230a3071ca83e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21774.exe

Filesize
468KB

MD5
73f423e1b503d3a7ea00683f573f7bc4

SHA1
f3e6e346294e0317fc898bb40ebd0fb036a6f677

SHA256
0b8e0c36ee1e8ce149e561a1156f6becab86d07c04a78b61394ced57d1a39078

SHA512
962a22f63915b37d40cc913a93bac8874a089f0504ba8d71497990b1bec550764dab2d38baf79945273d8aa66abb93d6f7ade8aaf0a1d1adae34495c3fd1c421

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe

Filesize
468KB

MD5
f300f999cd569c350f7d7caedb87481d

SHA1
6f8b3870fb4e932b1da4a5d4131a2639f735e508

SHA256
9a373fdf9efd24973b0b78850e2f6886aeb62b855e004ccd315520399f543b7f

SHA512
e11aa1279cd755fe0980f88a05d492b354ef66c2b42042a9f8c3d71e48097f9b4079f267f546a9ec67359c1b025007fa2b2c11b24691adaaf76698cf0f0a0f40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe

Filesize
468KB

MD5
5ff9eadfe04af287583ec7016cff226a

SHA1
dc4bab14757b22f91635d6570e878158a3b7ae0c

SHA256
d172179790b0058ce6ba13d34c0c785a9bf742b1c027a7793a7603a5352b8a3e

SHA512
3a1624d1eb4e2203a709aa8316e1ffc1d69373b0de40276eb3f8fe24471bad7cac0ff0e8aa981e00f3f78c3a5cd50cec76a9886d9e8dd60bff7b5de02d767f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40252.exe

Filesize
468KB

MD5
945b8cda566e8cf26b627e4a85cc2ca7

SHA1
f80efc82e988bf754f6eaae9b545696555bd2066

SHA256
b948ceaaa1d504fb93af8be1f0ad89b239dd2efb00ddc3773e7e167bc05a09ba

SHA512
ca5ce00fdfbaa08becec7ad3a7afaefe308ca647fe8bc982d4c61e00289d3838a2afb89c433c448263ffed18c919ff957089409229a603070523bd3b05eb9a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40335.exe

Filesize
468KB

MD5
54f55a11a7b1dcfc44666a209f64be33

SHA1
b48af3c50e382a1defa186796bc1eec78a09fff5

SHA256
1d47d86df28a12160a0bb5718f3a6d942124076256c17ba50e0825d2f23131b3

SHA512
1ebce13ebd9c32dcb659f6745e1740ad8d726ecbc8b29941cd33d206de8a5e816035ce84af177cb2e8631dd33b36bbe36e6d639a8ec4b69ecc320517359a2ae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe

Filesize
468KB

MD5
3a0ef7edbf6e20142461adb50ff410aa

SHA1
10592086536dbce746206699a14d1a50d69992d2

SHA256
2549396de5ee96ca88631fbbb27545ad0ae3de373b93bce0415c6305ad117a23

SHA512
bff09b2be3383bd15f912b3d3624ffbc7ec08cef3972242600a908b6b1a71d08a42e74f9c9473562f012123778372c537bc27357bfe4867a1aea619733516339

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe

Filesize
468KB

MD5
d87f3dcf280090e46a09ffe00dd993a9

SHA1
1fb0341aed9532c21de7c37485b12acc0c1a7ae5

SHA256
f2ba0a5bae767c843caa09389840139f84e3f6b3d0d14caa208d9e05da40e50b

SHA512
4f840e652c03ea24fe90c754d57e88c878b5c0e2353c51246f9609cd6e676867d70670f7dd07888c7726cd1439609c2eebfc29955db3f55b987f01e95e0c775f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe

Filesize
468KB

MD5
2666d2282125fa8c3bcee201658b087d

SHA1
b300df78b3fb28a6c915267f8f0267aba4d2ba11

SHA256
fe4c87f954ba3a29103a1b60a0443518cd276a95b3a64ca07dc32fca037d6b32

SHA512
5a9c89a479b6f66e5b03cdb25934f120e13e87569ebfc35025bf96f0762e062444daef7da7b285a9f655dcf4f42e4c770b233dd8b5f0a11039a2bc9f6c8dea47

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe

Filesize
468KB

MD5
2f82fc680c8a4ac5af481ab2aa1b3f4b

SHA1
efa25d74b876e84910a5117c8142004504d6be4d

SHA256
402c891ae5c692ee33253d258530c132dab0c8a336eb4630a8e795868cb07b83

SHA512
47a71af85c52507bdfb0a8b27d781b847e2f77af7ea568e01db1f274a5b901f4f67acdfc452d2c5abf7b35eeaefe6c0b995b0c7eac11f7be9c6ed0dba43bce73

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe

Filesize
468KB

MD5
f4e9ce098d99805e4fee4136b83c3084

SHA1
aeb99716b67f3676f3a0c8e11f9d1c37c01dc3f8

SHA256
4b2446b2fda525240d4200698351e87a22ec6307eea6763b3cdbf222e2283a6e

SHA512
92fa44d965f326e5f6c7250cdc05d0acb8ad7c68c4ba0267cba2c685082efe9d35cb0444548668847796f518606eddee4257744f95fc6cdd7b87aa5c9c5abb79

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19252.exe

Filesize
468KB

MD5
1c3b1fb6c8c732c8d8db6dbb733c7402

SHA1
b6104461a4ef8c69b6bcbc5ef149d06292302dae

SHA256
32464223434bbb8f2cc1d2828c45d94d3df7260892a85c0bd470c7f3401e63dd

SHA512
9b525fe5ee78a13f48ac60327296d68530a6fba523bea23cc8e13ec8eb470b7780571551ede6671614dd5a8cae4231e7326d3285dbfc5b3cda5ab8fd13c81ad0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19370.exe

Filesize
468KB

MD5
d8dd0b959281f6a2071f8bc00e14126f

SHA1
23f48ee85b09a051f0124ce36704ea625ab157d5

SHA256
3ba82fd3338cc968c7ae843f71416de2d64786ea70cdce432edf43f7f89f57e7

SHA512
4936ac7e0abdb5f397ce858ae834ee362a78273a57978e1c02a00bb58cf3e1f0434d15fd1d9eb8663c3937fd911b3dae4b5902153f888e4853e65f9b65f9e575

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33942.exe

Filesize
468KB

MD5
fc50539c2cfd1d5e8d9d60b618c91324

SHA1
6eacb2733788100fbbe7dc605a84e075a258b49e

SHA256
e56014d265ae5cba040146fe0e890b91dc75479d37472374cd34419bc64233c3

SHA512
b7b02d1516eb89f59da05f9b175302df77f7ff6ce7ba11d87d3c1f018ce0060346360a668c71678b8df1f79a526664b4d48121c9bad63055fc4dbb65ecb5716f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe

Filesize
468KB

MD5
461bdbfd241d1758e8209313dc311e17

SHA1
bc3505bae9d97f721d627d0b47fedafb0146b4ee

SHA256
bd25e2b4cc0c0194aeacb86c9e6e695ebd65fce40dd70afcf9de9a73ea272576

SHA512
9d667ce5809f76429c9860676bea2dffae63f6c80f682387465522fb94e418ccee2faff5751238ac805cbf993858f563651c52a32c4bf03a87b9c9058bcfe08c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe

Filesize
468KB

MD5
a625492b8b4923f7a32d727a2ecae620

SHA1
4d90133909d28557f2797b0eeac8cc756604bf4f

SHA256
ce9e59bca879054159e8bcbc84c077fd4761ce16f669eff901fbe4e3b8687de0

SHA512
85ebd2ab13e0cd7d689ab9a6cddd0ad17acf5c1d56fb1d60038953cd8456c081d5cdb9d3256a4ff30ad289f81a7cb8cda14d44a5aa793f1a138f837eaa87293a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49532.exe

Filesize
468KB

MD5
b6939e17e56dfd3662e2c2cca06dbf7a

SHA1
f75cbda88334504efede0df732bb0800c04f23a3

SHA256
8005366d3df9ab9f07b080ab5d34ae93e14efea0f80a4d092bc51e70bc78772f

SHA512
d513f389b2faf6e26b1662ec6ec4fda1e0e2d1c6b7a3b409eeca5dc282ef489f9516febb715f88c04b8a42e06b07c23c7e103c160c9fa18f8834bc7714592cfe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe

Filesize
468KB

MD5
072c340c81f543326c9b1aa7ec1c4ca4

SHA1
d6c74a7831b11d8ddea58e6730ffa4c51f148efd

SHA256
17e91d96d31a43e2984720fbfde0c2e9ee50e28f531241cb8c2c7194fb9019d1

SHA512
ac254cbf1e36347bb2aa47a819b237dd2fa3ac4c6e1058aebd4056a407867d68c81a49697091f7846842afd7d259455efc42f5127cddee5840b1cff8f0c37ec0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe

Filesize
468KB

MD5
7da8be9ec805bb671e12a3e6d9e11639

SHA1
9b49678afb77a4bbbc47453e5b876c96cdf84690

SHA256
5a4143ea8793a37c57291239035f63bb94d74575b681f04392b1a3310b96fb71

SHA512
e6ceaedef24a3b59fb9754bb3de04a425faa4d71d1932a08013809500a32ec57e7794c8494c4346a90a700831c3035242236c8de4dedfb730b8215a07d034b5f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe

Filesize
468KB

MD5
d749862fcfb059358ff94db433ceab13

SHA1
d67e826b94a4bd0a205f6787468c8a961830ce91

SHA256
1d5bb8a64b4ae905524c73e14d52f18092fca94829ac11cdce8c47517814d646

SHA512
35a3645efd98f49f76167482bc0a5d02e798d4455a173eb6c75c4326b5d59f722beefa7f54057737af42edd58ba13946deed102a63f44c14e3425d9e33fbf588

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8130.exe

Filesize
468KB

MD5
c7b74add667da71027bedf5fba2347c0

SHA1
e5ea67db9528d4f71e2d400477c5ffa3a70fc512

SHA256
d85eefd6d1b5d500359a74e5bb22e8fe19e2738286786d952e4165f0362d149a

SHA512
01db552ec11fca4977dfb047e0bfd0b322f528148251a840aa79fe7c96a71c90b9beaed2e770f91e7f75f4dac90db97e4ce5fccffc9bff0e44f5a6031832ef4b

Download Submit