fc5239716811b4d9beb59017a17a0540a4c8d651f39a44f66cba8f1c90accce4

Analysis

max time kernel
119s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b5f005c2e52de506f01b2914b7848c0N.exe
Size

468KB
MD5

2b5f005c2e52de506f01b2914b7848c0
SHA1

1c47f2d0609de3aef339569e83bb8a10e501ac30
SHA256

fc5239716811b4d9beb59017a17a0540a4c8d651f39a44f66cba8f1c90accce4
SHA512

da54e463d83c5b724908d1681b7365c9107f71deedfe167a2321b0c290b85c0e5c991c430eb62f63e415987497a900c49b401dc3f83a670a5ce57ffbc9aaca58
SSDEEP

3072:W1N/ogLda58Un+/SPz5FafwdfhzWI8J9mHe0V3oF2LaflFN4wl6:W11o9qUnBP1FafBxB/F2OtFN4

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2768	Unicorn-28958.exe
2548	Unicorn-23093.exe
2476	Unicorn-24358.exe
2596	Unicorn-61215.exe
2184	Unicorn-53130.exe
2356	Unicorn-61033.exe
2100	Unicorn-65382.exe
1716	Unicorn-27042.exe
348	Unicorn-36841.exe
864	Unicorn-64038.exe
2876	Unicorn-18367.exe
2436	Unicorn-17604.exe
3032	Unicorn-61245.exe
1788	Unicorn-1838.exe
2404	Unicorn-47510.exe
788	Unicorn-46161.exe
3040	Unicorn-46716.exe
1676	Unicorn-17935.exe
2500	Unicorn-37801.exe
1840	Unicorn-3545.exe
2316	Unicorn-65019.exe
2076	Unicorn-36331.exe
2088	Unicorn-42196.exe
2380	Unicorn-3674.exe
316	Unicorn-42461.exe
1580	Unicorn-29140.exe
2684	Unicorn-49560.exe
2752	Unicorn-29694.exe
1968	Unicorn-43430.exe
2520	Unicorn-46244.exe
1648	Unicorn-34546.exe
1976	Unicorn-23686.exe
1636	Unicorn-33891.exe
1232	Unicorn-60442.exe
2040	Unicorn-25531.exe
2036	Unicorn-935.exe
2080	Unicorn-32984.exe
1988	Unicorn-52850.exe
2880	Unicorn-32984.exe
2864	Unicorn-5687.exe
2712	Unicorn-11817.exe
1320	Unicorn-9679.exe
768	Unicorn-7276.exe
1256	Unicorn-22486.exe
2336	Unicorn-1319.exe
3048	Unicorn-1319.exe
1228	Unicorn-64095.exe
276	Unicorn-16377.exe
932	Unicorn-26592.exe
1800	Unicorn-26592.exe
1752	Unicorn-24189.exe
880	Unicorn-15523.exe
1776	Unicorn-32622.exe
2816	Unicorn-20924.exe
2928	Unicorn-44874.exe
2696	Unicorn-52810.exe
2672	Unicorn-41344.exe
2416	Unicorn-19685.exe
1688	Unicorn-20239.exe
1684	Unicorn-52357.exe
752	Unicorn-37967.exe
592	Unicorn-19227.exe
2460	Unicorn-51542.exe
2988	Unicorn-22207.exe

Loads dropped DLL 64 IoCs

pid	Process
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2548	Unicorn-23093.exe
2548	Unicorn-23093.exe
2476	Unicorn-24358.exe
2476	Unicorn-24358.exe
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2596	Unicorn-61215.exe
2596	Unicorn-61215.exe
2548	Unicorn-23093.exe
2548	Unicorn-23093.exe
2184	Unicorn-53130.exe
2184	Unicorn-53130.exe
2476	Unicorn-24358.exe
2356	Unicorn-61033.exe
2476	Unicorn-24358.exe
2356	Unicorn-61033.exe
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2548	Unicorn-23093.exe
2548	Unicorn-23093.exe
1716	Unicorn-27042.exe
1716	Unicorn-27042.exe
2596	Unicorn-61215.exe
2596	Unicorn-61215.exe
348	Unicorn-36841.exe
348	Unicorn-36841.exe
2184	Unicorn-53130.exe
2184	Unicorn-53130.exe
2876	Unicorn-18367.exe
2876	Unicorn-18367.exe
2100	Unicorn-65382.exe
2100	Unicorn-65382.exe
2356	Unicorn-61033.exe
2356	Unicorn-61033.exe
3032	Unicorn-61245.exe
3032	Unicorn-61245.exe
2548	Unicorn-23093.exe
2548	Unicorn-23093.exe
2476	Unicorn-24358.exe
2476	Unicorn-24358.exe
2436	Unicorn-17604.exe
2436	Unicorn-17604.exe
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2404	Unicorn-47510.exe
2404	Unicorn-47510.exe
1788	Unicorn-1838.exe
1716	Unicorn-27042.exe
2596	Unicorn-61215.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2540	2768	WerFault.exe	30
1576	1580	WerFault.exe	56

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33542.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2644	2b5f005c2e52de506f01b2914b7848c0N.exe
2768	Unicorn-28958.exe
2548	Unicorn-23093.exe
2476	Unicorn-24358.exe
2596	Unicorn-61215.exe
2184	Unicorn-53130.exe
2356	Unicorn-61033.exe
2100	Unicorn-65382.exe
1716	Unicorn-27042.exe
348	Unicorn-36841.exe
864	Unicorn-64038.exe
2876	Unicorn-18367.exe
2436	Unicorn-17604.exe
1788	Unicorn-1838.exe
3032	Unicorn-61245.exe
2404	Unicorn-47510.exe
788	Unicorn-46161.exe
3040	Unicorn-46716.exe
1676	Unicorn-17935.exe
2500	Unicorn-37801.exe
1840	Unicorn-3545.exe
2316	Unicorn-65019.exe
2076	Unicorn-36331.exe
2684	Unicorn-49560.exe
2380	Unicorn-3674.exe
2088	Unicorn-42196.exe
316	Unicorn-42461.exe
1968	Unicorn-43430.exe
1580	Unicorn-29140.exe
2752	Unicorn-29694.exe
2520	Unicorn-46244.exe
1648	Unicorn-34546.exe
1636	Unicorn-33891.exe
1976	Unicorn-23686.exe
1232	Unicorn-60442.exe
1988	Unicorn-52850.exe
2040	Unicorn-25531.exe
2880	Unicorn-32984.exe
2036	Unicorn-935.exe
2080	Unicorn-32984.exe
2712	Unicorn-11817.exe
2864	Unicorn-5687.exe
1320	Unicorn-9679.exe
768	Unicorn-7276.exe
1256	Unicorn-22486.exe
2336	Unicorn-1319.exe
3048	Unicorn-1319.exe
1228	Unicorn-64095.exe
932	Unicorn-26592.exe
276	Unicorn-16377.exe
1800	Unicorn-26592.exe
1752	Unicorn-24189.exe
2816	Unicorn-20924.exe
880	Unicorn-15523.exe
1776	Unicorn-32622.exe
2928	Unicorn-44874.exe
2696	Unicorn-52810.exe
2672	Unicorn-41344.exe
2416	Unicorn-19685.exe
1688	Unicorn-20239.exe
1684	Unicorn-52357.exe
752	Unicorn-37967.exe
592	Unicorn-19227.exe
2988	Unicorn-22207.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2768	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	30
PID 2644 wrote to memory of 2768	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	30
PID 2644 wrote to memory of 2768	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	30
PID 2644 wrote to memory of 2768	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	30
PID 2768 wrote to memory of 2540	2768	Unicorn-28958.exe	31
PID 2768 wrote to memory of 2540	2768	Unicorn-28958.exe	31
PID 2768 wrote to memory of 2540	2768	Unicorn-28958.exe	31
PID 2768 wrote to memory of 2540	2768	Unicorn-28958.exe	31
PID 2644 wrote to memory of 2548	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	32
PID 2644 wrote to memory of 2548	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	32
PID 2644 wrote to memory of 2548	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	32
PID 2644 wrote to memory of 2548	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	32
PID 2644 wrote to memory of 2476	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	33
PID 2644 wrote to memory of 2476	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	33
PID 2644 wrote to memory of 2476	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	33
PID 2644 wrote to memory of 2476	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	33
PID 2548 wrote to memory of 2596	2548	Unicorn-23093.exe	34
PID 2548 wrote to memory of 2596	2548	Unicorn-23093.exe	34
PID 2548 wrote to memory of 2596	2548	Unicorn-23093.exe	34
PID 2548 wrote to memory of 2596	2548	Unicorn-23093.exe	34
PID 2476 wrote to memory of 2184	2476	Unicorn-24358.exe	35
PID 2476 wrote to memory of 2184	2476	Unicorn-24358.exe	35
PID 2476 wrote to memory of 2184	2476	Unicorn-24358.exe	35
PID 2476 wrote to memory of 2184	2476	Unicorn-24358.exe	35
PID 2644 wrote to memory of 2356	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	36
PID 2644 wrote to memory of 2356	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	36
PID 2644 wrote to memory of 2356	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	36
PID 2644 wrote to memory of 2356	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	36
PID 2596 wrote to memory of 2100	2596	Unicorn-61215.exe	37
PID 2596 wrote to memory of 2100	2596	Unicorn-61215.exe	37
PID 2596 wrote to memory of 2100	2596	Unicorn-61215.exe	37
PID 2596 wrote to memory of 2100	2596	Unicorn-61215.exe	37
PID 2548 wrote to memory of 1716	2548	Unicorn-23093.exe	38
PID 2548 wrote to memory of 1716	2548	Unicorn-23093.exe	38
PID 2548 wrote to memory of 1716	2548	Unicorn-23093.exe	38
PID 2548 wrote to memory of 1716	2548	Unicorn-23093.exe	38
PID 2184 wrote to memory of 348	2184	Unicorn-53130.exe	39
PID 2184 wrote to memory of 348	2184	Unicorn-53130.exe	39
PID 2184 wrote to memory of 348	2184	Unicorn-53130.exe	39
PID 2184 wrote to memory of 348	2184	Unicorn-53130.exe	39
PID 2476 wrote to memory of 864	2476	Unicorn-24358.exe	40
PID 2476 wrote to memory of 864	2476	Unicorn-24358.exe	40
PID 2476 wrote to memory of 864	2476	Unicorn-24358.exe	40
PID 2476 wrote to memory of 864	2476	Unicorn-24358.exe	40
PID 2356 wrote to memory of 2876	2356	Unicorn-61033.exe	41
PID 2356 wrote to memory of 2876	2356	Unicorn-61033.exe	41
PID 2356 wrote to memory of 2876	2356	Unicorn-61033.exe	41
PID 2356 wrote to memory of 2876	2356	Unicorn-61033.exe	41
PID 2644 wrote to memory of 2436	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	42
PID 2644 wrote to memory of 2436	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	42
PID 2644 wrote to memory of 2436	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	42
PID 2644 wrote to memory of 2436	2644	2b5f005c2e52de506f01b2914b7848c0N.exe	42
PID 2548 wrote to memory of 3032	2548	Unicorn-23093.exe	43
PID 2548 wrote to memory of 3032	2548	Unicorn-23093.exe	43
PID 2548 wrote to memory of 3032	2548	Unicorn-23093.exe	43
PID 2548 wrote to memory of 3032	2548	Unicorn-23093.exe	43
PID 1716 wrote to memory of 1788	1716	Unicorn-27042.exe	44
PID 1716 wrote to memory of 1788	1716	Unicorn-27042.exe	44
PID 1716 wrote to memory of 1788	1716	Unicorn-27042.exe	44
PID 1716 wrote to memory of 1788	1716	Unicorn-27042.exe	44
PID 2596 wrote to memory of 2404	2596	Unicorn-61215.exe	45
PID 2596 wrote to memory of 2404	2596	Unicorn-61215.exe	45
PID 2596 wrote to memory of 2404	2596	Unicorn-61215.exe	45
PID 2596 wrote to memory of 2404	2596	Unicorn-61215.exe	45

C:\Users\Admin\AppData\Local\Temp\2b5f005c2e52de506f01b2914b7848c0N.exe
"C:\Users\Admin\AppData\Local\Temp\2b5f005c2e52de506f01b2914b7848c0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 200
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23093.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23093.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61215.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17935.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60442.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        8⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        8⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55634.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        8⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        8⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        7⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        7⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exe
        6⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        7⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        7⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        7⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
        6⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8747.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25531.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
        6⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        7⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
        6⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40471.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        5⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        6⤵
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exe
        5⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42327.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40120.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 240
        6⤵
        Program crash
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20924.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
        6⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23450.exe
        7⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        6⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29480.exe
        5⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        6⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23128.exe
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59485.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
        6⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20789.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        5⤵
        
        PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41833.exe
        6⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1353.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        5⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57679.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        6⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24296.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        5⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57726.exe
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        6⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28411.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55634.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3162.exe
      4⤵
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        5⤵
        
        PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14560.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45090.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49917.exe
      4⤵
      PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
        7⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        8⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        8⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        8⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        7⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24296.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        6⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exe
        7⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        7⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
        6⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        6⤵
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64095.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe
        6⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34903.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
        5⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15166.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
        5⤵
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29694.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        6⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30601.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5822.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26853.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exe
        5⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        6⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56201.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17262.exe
        5⤵
        
        PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1908.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34903.exe
        6⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        6⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        5⤵
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
      4⤵
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38915.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65019.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25113.exe
        6⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        7⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60478.exe
        5⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17031.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
        6⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57580.exe
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22486.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20744.exe
        5⤵
        
        PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58064.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
      4⤵
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26436.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
      4⤵
      PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42196.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59731.exe
        5⤵
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        6⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exe
        5⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57144.exe
        5⤵
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
      4⤵
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
      4⤵
      PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
      4⤵
      PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      4⤵
      PID:6368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15523.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
      4⤵
      PID:352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55488.exe
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59310.exe
    3⤵
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
    3⤵
    PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
    3⤵
    PID:5396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24358.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24358.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53130.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36841.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46244.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62287.exe
        8⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        8⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        8⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        7⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        7⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20239.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53408.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3775.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37548.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        7⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22207.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        7⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        8⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23059.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exe
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32962.exe
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
        7⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36497.exe
        5⤵
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
        6⤵
        
        PID:584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37967.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        7⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        7⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        6⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62645.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        5⤵
        Executes dropped EXE
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        6⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34128.exe
        7⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        6⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        6⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20744.exe
        5⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18914.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26436.exe
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        6⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        5⤵
        
        PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19227.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
      4⤵
      PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
      4⤵
      PID:2808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10338.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        6⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5276.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55634.exe
        6⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        5⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
      4⤵
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        5⤵
        
        PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53143.exe
      4⤵
      PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26436.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
      4⤵
      PID:6352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9679.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
        5⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59154.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        5⤵
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
      4⤵
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        5⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        5⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
      4⤵
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26026.exe
      4⤵
      PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
      4⤵
      PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
        5⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe
        5⤵
        
        PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24296.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      4⤵
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
    3⤵
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41726.exe
      4⤵
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17243.exe
      4⤵
      PID:1364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
    3⤵
    PID:3276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
    3⤵
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
    3⤵
    PID:5356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
        6⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        7⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        7⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        7⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        6⤵
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17243.exe
        6⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
        5⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49660.exe
      4⤵
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        5⤵
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31680.exe
      4⤵
      PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43348.exe
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
      4⤵
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        5⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26875.exe
        6⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47928.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7009.exe
        5⤵
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        5⤵
        
        PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
      4⤵
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42355.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
      4⤵
      PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      4⤵
      PID:5348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54228.exe
      4⤵
      PID:112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        5⤵
        
        PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        5⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57144.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
      4⤵
      PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
      4⤵
      PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-678.exe
    3⤵
    PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33035.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
    3⤵
    PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
    3⤵
    PID:5648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17604.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17604.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
        5⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        6⤵
        
        PID:952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17243.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
        5⤵
        
        PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exe
      4⤵
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
        5⤵
        
        PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20744.exe
      4⤵
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18914.exe
        5⤵
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
      4⤵
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58064.exe
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
      4⤵
      PID:5904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41344.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47383.exe
      4⤵
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16938.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18914.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
      4⤵
      PID:6312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57591.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
      4⤵
      PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7471.exe
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38487.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
    3⤵
    PID:5408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32622.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
      4⤵
      PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
      4⤵
      PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
    3⤵
    PID:3532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
    3⤵
    PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
    3⤵
    PID:5744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
    3⤵
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
      4⤵
      PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
      4⤵
      PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
    3⤵
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
    3⤵
    PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
    3⤵
    PID:5948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exe
  2⤵
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10616.exe
    3⤵
    PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe
    3⤵
    PID:4192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9432.exe
    3⤵
    PID:6132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe
  2⤵
  PID:3248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31465.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31465.exe
  2⤵
  PID:3812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
  2⤵
  PID:4804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
  2⤵
  PID:5372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe

Filesize
468KB

MD5
3f541cb48c02559b4e468fce7cbc7224

SHA1
ea9b400f46622d5c5382cf2c68a12708f179e4fd

SHA256
83b738da88c18f74c7c43a777eae07923602332ae8fc624bb9e6a2cb2a799921

SHA512
0dac1516553e82f1eec84de0bfc7013695ba500045ecb9276bcf6bef51cb5795651c560c71e9553659627cec5a9124e97875635aae78c17bd38e1adcdda3baf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe

Filesize
468KB

MD5
1a9c6443bdefa6f6ca39b54a1405ca82

SHA1
d9b03f5a14c9631fa27c7938a727f7c471d64c80

SHA256
82b8cacaca9ec2862ab5582a87b651f444598f9a2459c3382d93a3b62d4283f1

SHA512
ceb0b5839ae0607540d734d5b0af2e9f1fa48557d6540e5c44c637c83efb8e2a4aa400dd4de97a26797cb03fac5668240b328e763a09d637ff46928fe479d750

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe

Filesize
468KB

MD5
08f7e0b9f99c6dafdea7a7b8c993a3e0

SHA1
2159c6c7aee7ea5595bb203cf17e0180a65d713b

SHA256
08c20248726def68edc96bc2ca15aa7396f5e911fd3b8013876dd02933e054f7

SHA512
5b3dd42accf6e2946a7e5c8a69b3608471dcb91349c4d602f7d7f533b23929516508962c58743ee2de936f541ff9b5fb2e7ad856e5df44ca32ab60a0a1690a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe

Filesize
468KB

MD5
074588fd6eb255959f4e890a387df1b5

SHA1
49fedf25707b11382b13c3d09e9cbae9f0fa7d62

SHA256
6ebc0349bdc00fd2456dc1311f054e03fbdcc11e60f4c7b67966c01c1fc72f78

SHA512
34afe7d470fb2ddce54209153e84a4a1fbb76b4733b7cac22eb186dba3281bdae87f95b7bb7d7b519aa0279603c5b9f7b412025dcef8a407c7958c567feb9a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe

Filesize
468KB

MD5
243600328b082f4ecfd36fad051eb721

SHA1
9e4c1ef344595c6873952aa181ec63024e536265

SHA256
c1db31300b61b83cbfcb8f5be3e797f14fcb11311aa86fab1657c6a08108733a

SHA512
7ce8f9e8b86c50722bee3b30642a0b8e13014c18b50659bb8d7edbe8b7bba0d608e6899d20d78f42ac10ac7fa08f8e01e079a5e0769bfc167bbc2ec1c949404f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe

Filesize
468KB

MD5
e998aeeb517f85096a92fab8d95aeda7

SHA1
6bb3a3fde972443ef983dc4eb1fe7f551f510c6a

SHA256
9905ddaee3021352267d9baa41afdfbc7e5de4a73aeb83c004684928877ca5ea

SHA512
4d731563132e0312438a14ce72ea49729b7e80e04d00fbc886cdca6ee2e698d5916e2a430116ca2b60e5705b941d90c9f2ef4543fae656a153a34a110ba1e6b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe

Filesize
468KB

MD5
a317f32b433bac702fe12ee5d855e8fd

SHA1
6297d96e7a180eb2a4b3ea5139ecceef19c24786

SHA256
e6610368725578b5ba5c211445f911aa88aefb4eb41d4a61f4ff5ea4937299ce

SHA512
b724b023c7d3d920ab54f187c8550c6c0d8187f2b6d79a8596142d4db372b22924f056416c6873810818d37d54b438bc733654e6d35ff2abf0c4ed15cb0ce486

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17604.exe

Filesize
468KB

MD5
e2a1372e65c26b80a4fc62a54a0bf14d

SHA1
8565db500d160dc5074560f0b41c6cd577a3cb53

SHA256
6ad46d3deb274613e60162c5741215f44b7939419a1f489c1be3f88d878d7df7

SHA512
84db807769e7e1013a4bd1adc29fd3cb4bcf7ff272014f56bfaa287f05086ad246767fe873187963fa8586014e4f06ef5daf81f7d87f061fe9ad8abbfe4f967c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe

Filesize
468KB

MD5
3911b248baa5e3d10151c45d61b4f397

SHA1
207a883215b38d06ae99bc6e19ea2e4a94809ae1

SHA256
30588708b29bc13207eb928cecbd426d428ca984768d45f682a4d19eb63ba245

SHA512
85a74b3f35b87954f8843bf7c5eec9af00b3d17f2f694b7c24303ada288dbb3e364bacae9a24ac83000fbe4cd750b000efc2060176771f461796f01671051c72

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23093.exe

Filesize
468KB

MD5
32b92852f16d8dfdadbcf8332ef57ff2

SHA1
7e0e4a2d7b5c1f02ac2658f6d904e78b7c8cabe8

SHA256
4c7a080ea9a60acd8085c5b2cb4e3b3e840ed28c41a158a67ade8e1f879e62a0

SHA512
5bd99b23471ae1954a62e33fe10451933410e6c6f9829f8f7078e0087d4c3db8a627c20c0a344f9a275925da7dbcf14f36bd784d608d533e5c44ce1f330f1fd6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24358.exe

Filesize
468KB

MD5
7257d4ed9cea3b78e04d681035f39aaa

SHA1
f3555caffbbfdff02ca9614387aae32e462c6327

SHA256
492bffc64c777bdb742ce11e8478d86a34d351d2a57711eefa92128db6befb78

SHA512
9d88f6cf0a6bd8930f0cafa05355d2128e4783c12bbb8aa441b11c52f4fb77267cf85e42c9cf1f63e9b3d20e2394667d6e92fe7ce65bc0b3724d2d9736b8f062

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe

Filesize
468KB

MD5
c4a9a2b1161185c4209fc9e5a6934d7f

SHA1
a74e2d70dd4f812a3dbbf3f33fc7a80f95b7a27b

SHA256
50db4752044c9684f3ffe968459dc9ccadcbfcf438ced33a530b161f09389edd

SHA512
25ee6b328361736a01140f2a11cbeb20c7e92928e5cc1566b566e9c77c800e500fa883ba47fa0d04f3655bcfd02f2ec3af2b76fe2686aa831163306ba275fd13

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36841.exe

Filesize
468KB

MD5
e5c7b9fcf9219dddb216e2f0fdf271ab

SHA1
ffd91656ff55fc918cb831057ead4c9d9699b959

SHA256
a1a61cdb737fac94a3d6409bf2c28e879e01ec41762a556de9f731b62097e652

SHA512
ae524c1c7491bee675f47bdea675030569022dad015740c92d6253f1852a28fc6ad48d7666f4cc30f2774d1b3af5c11cadd393f71c31df39f839ca5c599a321b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe

Filesize
468KB

MD5
c84bda1a94d3669bd04b4f5c02e3f128

SHA1
e47c00def926de4cb86fd57eab363d6489e8376f

SHA256
b964ec0cc374af50fbb36281e20f9835558279c103c9af478a9691027042cec4

SHA512
7ea123ec186d9f6cf434d404b64f6837e0530c442b8499bb9cef1df703ab04694e8070fa5d62344a9f52630b73c94b5a9b0739ed94904830fbd27cf2e153ff8d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53130.exe

Filesize
468KB

MD5
9fde5dd1b68b67dbfe819444962b8712

SHA1
0b9c58800f6c312ae76fe5979b3665d63002f32d

SHA256
3e333ef6f0820dde3d21a943c8ae6ed19375cfdbebbeb9be869f45701e608075

SHA512
aa5ef7ee8a8952e11e86d66219970e4ce4f7fc90c5327fa8672b252929e5d42618b4a72cae4131d9f32c1ff34b98ab2236c6355a71cf223777885143f02eeefd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe

Filesize
468KB

MD5
767fc1b3dcac114c11e18a193916111a

SHA1
60268f629e878e11c8d17a98311d32c343f48df8

SHA256
fd1e9dcc2a53855c8c590df669f5026b5e1b2f862569ad06c11cfd6ae2b2d7af

SHA512
69eebf0bd6fb45b159f1da18ae56e629a871a4f57cfbf710cb237b297fb211999e42a45f273f1c5cd67bd06cf4b889470e1085d6a894d74e9a90c54b8d62812c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61215.exe

Filesize
468KB

MD5
f059116f732895bc3301af5dc42fd0b2

SHA1
b5260d5cba515506cf62931f8f0cedd510cdbd24

SHA256
6a77390eae8fbf953ba95d3c6f34f394d2a2f8b146d153f4bb8638b2b526e45c

SHA512
13ca9bd3a609230a2189ab2aca4d9f48e94dbf2f79146e7ae21562bc71bf432e79c4b8654f4f8a1ad3226abb7876125e28467a0381db9cdd199ddad59d822bde

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe

Filesize
468KB

MD5
6536e14366394d214705984333d528d9

SHA1
bd9460a8991124cd904104f80d1667d207576bad

SHA256
cf53a2c18835ccae843c48788177b7e93b1a615d2f2dcb0375bd98da8d0ce3d9

SHA512
07ab7423763aab62c18214ce9266f1446516848d8899ac82c8edf51cd32243acb92f7057eea800f1ea919fd0a334364db7c1ffa38a12438387aeca509f65f8ec

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe

Filesize
468KB

MD5
6ce0d01b1346efe7c42cfd3640db8065

SHA1
7848b0a69d83050ffd10dcb48a50e3d0eaa90354

SHA256
21c16313a136885c8120b1c34d815a3234eaccb7454bae3e6a871a495c47a079

SHA512
68eb759f766105991e9ebd7112796f7a87c1b483612831762cfc976e860bf374991b26002f50721916d6b8e289493e21bb33abcf58ee045c326dd577cca9cab2

Download Submit
memory/316-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/348-358-0x0000000003410000-0x0000000003485000-memory.dmp

Filesize
468KB

Download
memory/348-357-0x0000000003410000-0x0000000003485000-memory.dmp

Filesize
468KB

Download
memory/348-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/348-207-0x0000000003410000-0x0000000003485000-memory.dmp

Filesize
468KB

Download
memory/348-206-0x0000000003410000-0x0000000003485000-memory.dmp

Filesize
468KB

Download
memory/788-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/788-347-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/788-348-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/864-418-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/864-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/864-417-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/1232-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1648-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-387-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/1676-386-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/1676-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-181-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/1716-308-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/1716-319-0x0000000002370000-0x00000000023E5000-memory.dmp

Filesize
468KB

Download
memory/1788-317-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1788-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-416-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/1840-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1968-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-398-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2100-235-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2100-397-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/2184-375-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2184-374-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2184-220-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2184-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2184-216-0x00000000028D0000-0x0000000002945000-memory.dmp

Filesize
468KB

Download
memory/2184-111-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/2316-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-244-0x0000000003250000-0x00000000032C5000-memory.dmp

Filesize
468KB

Download
memory/2356-140-0x0000000003450000-0x00000000034C5000-memory.dmp

Filesize
468KB

Download
memory/2356-240-0x0000000003250000-0x00000000032C5000-memory.dmp

Filesize
468KB

Download
memory/2356-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-295-0x0000000003220000-0x0000000003295000-memory.dmp

Filesize
468KB

Download
memory/2404-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-296-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/2436-291-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/2476-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-138-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2476-276-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2476-277-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2500-410-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2500-403-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2500-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-170-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2548-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-275-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2548-272-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2548-100-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2548-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-182-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2596-316-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2596-326-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2596-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-183-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2644-320-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2644-11-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2644-10-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2644-293-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2644-32-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2644-147-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2644-152-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2644-399-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2644-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-292-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2644-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-233-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/2876-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-234-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/3032-256-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3032-257-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3032-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-366-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download